-Everyone :: Traverse Folder / Execute File [Allow]
Make sure that you set that for "This folder only" in the advanced options, it means having to manually set that permission on each subfolder
All the USERENV 1509 & USERENV 1504 error messages in the event log have disappeared now.