[Samba] logon scripts not running

[Sonic]

Upgraded a Samba 3 PDC to a Samba 4.6.6 AD and the logon scripts are
no longer running on member (Windows) systems.
I can see the scripts in file explorer but can't directly access them
(permission denied).
However, I open a cmd prompt and run them with no issues -
\\ad\netlogon\logon.cmd works just fine.

On the AD I see this (assuming it's normal):
# ls -al /usr/local/samba/var/locks/sysvol/my.domain.com
total 0
drwxrws---+ 1 root 3000000  30 Jul 15 18:24 .
drwxrws---+ 1 root 3000000  42 Jul 15 18:24 ..
drwxrws---+ 1 root 3000000 152 Jul 15 18:24 Policies
drwxrws---+ 1 root 3000000  56 Jul 16 21:35 scripts

# ls -al /usr/local/samba/var/locks/sysvol/my.domain.com/scripts/
total 12
drwxrws---+ 1 root 3000000  56 Jul 16 21:35 .
drwxrws---+ 1 root 3000000  30 Jul 15 18:24 ..
-rwxr-----+ 1 root 3000000 244 Jul 16 20:40 logon.cmd

pdbedit -v user : shows
Logon Script:         logon.cmd

Again, running them directly from a command works fine, so I'm at a
loss to explain why the logon scripts no longer run when the user logs
on.

Please assist.

Thank you!

Chris