it seems that samba 4 replicates win 2008r2 server and per wiki logon script should not be used.when I tried to use netlogon.bat script in samba 4.13/14 it was never executed. I used gpo instead and that works