Home directory permissions issues.
Found: How to display the security permissions of a file from the filer which mentions the fsecurity command. Also found the white paper Bulk Security Quick Start Guide. Information about the Security Descriptor Definition Language SDDL at MSDN. From a comment on that page, I found Mark Minasiâ€™s newsletter describing the SDDL syntax.
After poking at a few things with SubInACL.exe, I used the secedit utility from NetApp to create a security job file.
I created a new file, added a locationâ€/vol/testvolâ€, then added the BUILTIN\Administrator user with Full Control. This generated a file containing the following:
The instruction are specific that you canâ€™t remove the â€œEveryoneâ€ ACE, which is exactly what I wanted to do. So I edited the generated text file to remove that ACE, resulting in the following:
The command fsecurity apply /vol/path/to/file appears to have corrected the permissions just fine. I edited the fileâ€™s location to another affect volume and that worked as well.