Qualify the username with server, like this:

$usr = 'DBF\netfiles'

And run elevated, otherwise your result will be "Access Denied".

That was all.

Funny how it works without server name qualification when using the non-global normal mapping call. That inconsistency threw me off.

I can make the mapping permanent (survives reboot) by using the Persistent argument.

Also, the drive letter created is accessible by Scheduled Tasks, even ones that have "Do not store password" enabled.

For reference the complete commands I used and that worked were:

$usr = 'DBF\netfiles'
$pwd = ConvertTo-SecureString -AsPlainText -Force 'the-password-for-this-user'
$rpa = '\\DBF\Movies'
$lpa = 'M:'
$creds = New-Object System.Management.Automation.PSCredential ($usr, $pwd)
New-SmbGlobalMapping -Persistent $true -Credential $creds -RemotePath $rpa -LocalPath $lpa