[Samba] "force user" option with NT4 domain

[Bowie Bailey]

I've read a fair amount about this problem online, but have yet to find 
a solution.

I have a CentOS 7 server running Samba 4.  It is connected as a member 
to an NT4 domain.  I have migrated over the configuration from an old 
Samba 2 server that I am trying to replace.

Everything works except for the shares that have a "force user" option.  
When it is there, I get an error on the Windows box saying "The security 
ID structure is invalid."  If I remove the option, the share works 
except that it is being accessed as the wrong user.

Someone suggested to put the user in the "valid users" list as well as 
"force user".  This has no effect.

The share in question looks like this:

[public]
    comment = Public Share
    path = /home/shares/public/public
    public = yes
    force user = pcguest
    valid users = pcguest
    writeable = yes
    browsable = yes
    printable = no

Any suggestions?

-- 
Bowie