The output for one of the shares is here
USILST76A> cifs shares ftp_ftpca
Name Mount Point Description
---- ----------- -----------
ftp_ftpca /vol/ftp_ftpca CA DLP Scanning share Mike Mendelsohn
... access based enum supported
TANT-A01\dlpfsa / Read
It is happening to every share that is using a unix qtree and is being shared via cifs. It doesn't happen to mixed shares as it appears on mixed shares it enforces the share and ntfs permissions.
This is on a domain. I thought it was something in usermap.cfg but after removing the line I thought was the problem it's still not enforcing the share permissions.