Do it every day:
File level, we use XCACLS.
xcacls \\filer01\wts\%1 /c /g administrators:f %1:c "domain\pc gurus":c
system:f /t /y
xcacls \\filer01\profiles\%1 /c /g administrators:f %1:F "domain\pc gurus":c
system:f /t /y
Share level, I use a combination of tools between RMTSHARE & "cifs shares
access"
rsh filer01 cifs shares -add %1 /vol/vol0/wts/%1
rsh filer01 cifs shares -change %1 -comment \"%1 WTS Home Directory\"
rmtshare \\filer\%1 /grant domain\%1:c /grant "pc gurus":c /grant
vette01\administrators:f /remove everyone
Also note that versions of Ontap less than 6 don't support NTFS5
permissions.
-----Original Message-----
From: Michael.Kaercher(a)genorz.de [mailto:Michael.Kaercher@genorz.de] 
Sent: Friday, September 14, 2001 7:39 AM
To: toasters(a)mathworks.com
Subject: Problem setting access rights for files on a CIFS share
programatically
Are you an NT administrator?
Have you tried to set up user's rights from a script?
If so: Please read on!
We have implemented a tool to create user accounts for an NT domain. This
tools also creates the user's home, group, and profile directories. Of
course, these directories must be properly protected from unauthorized
access. To this end, we are using Microsoft's ADsSecurity package (found in
the ASDI25SDK resource kit).
With the graphical tools for setting permissions on a remote file or
      directory
we can modify ACLs on the filer. However using ADSI doesn't work on the
      filer.
(The filer is running 5.3.7R2; ADSI is version 2.5))
We have found that the following (trivial) example program taken from the
Microsoft documentation works perfectly well from an NT4 domain controller
to another NT4 domain controller, an NT 4 member server, a Windows 2000
member server (of course, all belonging to the same domain), BUT: Setting
the new DACL with a NTFS share on the filer does not work (the existing
rights are correctly displayed, but setting just doesn't work - without
returning an error code!).
                                                                            
     Const ADS_RIGHT_GENERIC_READ = &H80000000                              
     Const ADS_RIGHT_GENERIC_EXECUTE = &H20000000                           
     Const ADS_ACETYPE_ACCESS_ALLOWED = 0                                   
     Set sec = CreateObject("ADsSecurity")                                  
     Set sd = sec.GetSecurityDescriptor("FILE://\\SERVER\DIR\FILE.TST")     
     Set dacl = sd.DiscretionaryAcl                                         
                                                                            
     '-- Show the ACEs in the DACL ----                                     
     For Each ace In dacl                                                   
         wscript.echo ace.Trustee                                           
         wscript.echo ace.AccessMask                                        
         wscript.echo ace.AceType                                           
     Next                                                                   
                                                                            
     '--- Add a new ACE so that the user can read/execute this file         
     Set ace = CreateObject("AccessControlEntry")                           
     ace.Trustee = "DOMAIN\user"                                            
     ace.AccessMask = ADS_RIGHT_GENERIC_READ Or ADS_RIGHT_GENERIC_EXECUTE   
     ace.AceType = ADS_ACETYPE_ACCESS_ALLOWED                               
     dacl.AddAce ace                                                        
     sd.DiscretionaryAcl = dacl                                             
     sec.SetSecurityDescriptor sd                                           
                                                                            
                                                                            
 BTW: Using the Win32::Perms perl module shows the same behaviour!          
                                                                            
 Thanks,                                                                    
 Michael Kärcher