We used the trick of moving over the .trustee_database.xml file to restore our NCP trustee rights. Everything looks good there, but when we used the ncpcon nss resync=volume option it didn't apply those trustee assignments back to the NSS file system. Running the ncpcon nss verify=volume confirms all of our NCP rights are there and happy, but the nssrights are all empty.