Root Folder permissions not propagating to subfolders

My approach is to not use file/directory level file permissions; use file share level permissions, and set the whole server filesystem data drive to Everyone Full Control (which becomes moot).

Over the years (10+), I have found that NTFS permissions are more complex and leads to more errors. If the permissions are set wrong, or the inheritance gets broken, you expose data and its hard to find and see it. Plus, you are exposed to the move/copy problem as you say.

Places where you have to use directory/file level ACL's; I know of no other solution than health checking the thing on a regular basis.

Unless something drastic has changed in 2012, the following should work.

Set the share on the server (in your case UserData$) with Full Control for the Admins/Domain Admins, and Everyone as "Change and Read".

On the NTFS folder "UserData" set the permissions explicit without inheritance and only grant Domain Admins Full control, along with anyone outside of Domain Admins that needs to see all folders.

Then when you create the user in AD and set their home folder that subfolder %username% will automically be granted Full Control for that user. Since they can traverse the UserData folder to map a drive to \server01\UserData$\%username% they get access to only that folder. Mapping a drive to \server01\UserData$ will be useless for them.

That's how we've always set ours up over the years.

Now with 2012 you can easily enable ABE http://heineborn.com/tech/enable-access-based-enumeration-in-windows-server-2012/ where the users only see folders they have rights to, but this isn't even necessary if you do the above.