NTFS Security Question

[AngelicKnight]

I'm writing up a FAQ series of documents for the other region IT departments for our company, and one of the subjects I'm writing on is how to setup AD groups. I'm also including a troubleshooting area for common problems.

Thinking about this brought up a question I'm not sure on -- I know that typically, if you have a Deny permission set for an individual user, it will override any Allow permissions given elsewhere for the same directory. However, what about in a scenario where, say, a user is a member of two AD groups -- we'll call them Group1 and Group2 -- where Group1 has Allow permission set to a directory while Group2 has Deny permission set. Is the user, being a member of both groups, therefore denied access?

Basically, whereas Deny permissions override Allow permissions for ONE user, what about a user in MUlTIPLE groups, where one group has Allow and the other Deny?

My guess is Deny still overrides, but just wanted to confirm...