Thanks to Keith Brown of Netapp! His answer was right. After connecting a drive (or being told the user is not allowed), changing the permissions is not adequate. The user has to log out of NT. Keith suggested also doing "cifs terminate workstation-name" on the toaster, which I'll try next time.
Thanks to Mark Muhlestein of Netapp for following up to make sure I'm a satisfied customer. I think we get more than our money's worth on this mailing list. :-) What other vendor follows up so thoroughly?
Thanks to all others who tried.