Active Directory安全性-用户组与用户权限

Question

I have denied to a specific user to write on a file. But this user is a member of a User Group which can write on this file. So there is a conflict between User vs. User-Group rights. Which one will prevail here?

Answer 1

Any "deny" should rule trump any "allow" rule, regardless of whether the deny or the allow was assigned to a user or a group. For a brief discussion, see http://blogs.msdn.com/b/oldnewthing/archive/2007/06/08/3150719.aspx . For more details, see the "Access Control Lists" and "Access Control Entries" sections at http://msdn.microsoft.com/en-us/library/windows/desktop/aa374862.aspx .