Samba 4 equivalent of "security mask"/"directory security mask"?

English Applications
1

Windows clients insist on creating files and directories in users’ shares with -rw-rwx— and -rwxrwx—, respectively. I want to force -rw------- and -rwx------ on the server side (except in groups shares, where things are working as I want). I have inherit acls set to yes (and the user share directories has default:group::— in their ACL), as well as create mask and directory mask of 0600 and 0700, respectively. In Samba 3, I could use security mask and directory security mask to prevent Windows clients from overriding these, but these options were removed in Samba 4. How do I achieve equivalent functionality?

2

create mask, directory mask and force versions still work. For example:

create mask = 0664
directory mask = 0775

force create mode = 0664
force directory mode = 0775

Adjust according to your needs, of course.