Can Samba4 create files with a GID other than AD's "Primary Group"?

Question

I have a Windows 2012 R2 AD. Users all are members of the group "domain users", and then each user is also a member of another group, depending on department. All users have "domain users" as their "primary group" in AD. So it looks somethin like this:

uid=40001(user1) gid=123456(domain users) groups=123456(domain users),50001(dep1),301(BUILTIN\users)
uid=40002(user2) gid=123456(domain users) groups=123456(domain users),50002(dep2),301(BUILTIN\users)
uid=40003(user3) gid=123456(domain users) groups=123456(domain users),50002(dep2),301(BUILTIN\users)

Now, on the Samba share, their home directories shall be owned by user:dep. I create the directories, chown to the appropriate group and set the guid to be sticky:

drwxrws---+ 4 user1   dep2 41 Jan 13 17:30 user1
drwxrws---+ 3 user2   dep2 22 Jan 13 17:30 user2
drwxrws---+ 3 user3   dep2 22 Jan 13 17:30 user3

in the /etc/samba/smb.conf I have configured the home directories as follows:

[homes]
        comment = Home Directories
        browseable = no
        writable = yes
        directory mask=2770
        force directory mode=2770
        create mask=2770
        force create mode=2770
        force security mode=2770
        force directory security mode=2770

But whenever I mount the share in windows and create a file or directory inside, it will be owned by the default group:

-rwxrwx---+ 1 user1   domain users  0 Jan 14 13:16 Test.txt

How can I get samba to use the depX groups for new files and directories?

Answer 1

IRL it does not matter what group owns the files in user's personal folder: no one should have a way to mount it except for user the owner. Here's my config for "homes" share:

[homes]
    comment = %S: personal folder
    valid users = @MYDOMAIN\my-subdomain-users
    read only = No
    browseable = No
    browsable = No
#    root preexec = /usr/local/sbin/mkhomedir.sh %D %S
    volume = %U-%S
    vfs objects = recycle:keeptree=yes
    create mask = 700
    directory mask = 700
    path = /home/%D/%U

Note the masks: I prohibit any access to files and folders for all users and groups except for the owner (700). You on contrary ALLOW the full access for group. Do you really need that on personal folders?

PS. As to commented "root preexec": older SAMBAs (before 4) could not auto-create home directories and needed such "medical crutch". Also note the path: I created symlink for my subdomain (I will not allow use this share for users from other subdomains): /home/MYDOMAIN --> /var/samba/homes/MYDOMAIN and samba creates users' subdirs inside the path specified: %D replaced with MYDOMAIN and %U - with user's logon name.