Although Deny permissions generally take precedence over allow permissions, this is not always the case. An explicit “allow” permission can take precedence over an inherited “deny” permission. http://www.virmansec.com/blogs/skhairuddin

Hello, this doesn't belong to Dircetory Services, it is about NTFS permissions and how they are configured. The easiest option is to configure some test folders, security groups and users and try it. Please use the following forum, thank you for understanding: http://social.technet.microsoft.com/Forums/en/winservergen/threadsBest regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi All If one user is a member of two different security group ,One group has full access permission and other group has Restricetd permission for particular folder in network, Which Permission will take effect. How do I achive to apply restricted permission for that particular member user without removing from any of the group or creating any addition group. Thanks Vijay

Hi, What do you mean when you say "Restricted permission"? Is it only a subnet of FULL CONTROL permission or a explicit DENY? Generally speaking, the member will have a combination of ALLOW permissions from those two groups and DENY always takes precedence when you set any. To achieve your goal, set explicit DENY permission for this individual user account.

you cant, permissions are cummulative (so effective permission will be the combination of both groups). the only way you could influence this would be to give the specific user a deny which would overrule, but deny's are not exactly "best practice", so it would be better to introduce a third group from my view