[Samba] Permission masks

[John]

I apologise for asking a basic question but I haven't been able to
determine a sensible answer.

I am using 4.1.17 as AD-DC. All configured and working with user home
directories via [homes] and some other specific shares.

Windows 7 client jointed to domain, users can log in and create files in
their home directory.

However the system permissions on those files are not what I expect and
I am trying to understand why.

My [homes] sets "create mask" and "directory mask" to 0700 but
everything created has "0770".

I have another share with a create mask of 0755. Files in there get 0775.

I have checked with testparm that there is nothing configured to set to
0770 anywhere. it's like there is a "force create mode" but there isn't:

$ testparm -v | grep -e 'force.*mode'
    force create mode = 00
    force directory mode = 00

What am I missing? What could be overriding my permissions ?

Thanks for any advice,
John