I's'll gauchely answer my own post.
This root dir contains LocalUser\firstuser; I've checked and triple-checked NTFS perms from D: all the way down. It's there and should be accessible. But it isn't.
OK, so then I tried D:\userdir\FTP_ROOT\office.place\firstuser. Still no joy.
The directory under FTP_ROOT needs to be the OLD-STYLE windows domain name, not the internet-style domain name, as in:
D:\userdir\FTP_ROOT\OFFICE\firstuser
Soon's I did that, it worked; the users I've created can log in, and they are limited to that which NTFS security allows.
There is joy in the Blue Ridge today!
N