I have a question about precedence among conflicting inherited permissions. Let's say I have a folder hierarchy comprising three folders: Folder 1 contains Folder 2, which contains Folder 3. I grant Clerks Modify access on Folder 1. I add a permission that denies Clerks Full Control on Folder 2. And I add a permission that grants Clerks Read access on Folder 3. If memo.doc resides in Folder 3 and has no explicitly defined permissions in its ACL, what type of access would Clerks have to memo.doc?
Clerks could only read memo.doc. Deny permissions override allow permissions from the same or a higher parent.
Here's how Windows evaluates permissions on an object: First, Windows evaluates deny permissions explicitly defined on the object (i.e., not inherited). If any of the permissions being requested are denied the user or any of the user's groups, Windows rejects the request with access denied.
Next, Windows evaluates explicit allow permissions. If all the permissions being requested are collected from access control entries (ACEs) for the user or the user's groups, Windows approves the access request and doesn't bother looking at the rest of the ACL, even if it contains applicable deny permissions inherited from parents.
If requested permissions remain to be filled, Windows then looks at the permissions inherited from the immediate parent folder, first checking deny and then allow. The process continues with the next- closest parent until Windows finds an applicable permission that denies one of the permissions being requested or collects all the permissions being requested. If Windows makes it to the end of the ACL without collecting all the requested permissions, Windows rejects the access request. Therefore, deny permissions override only allow permissions that are defined on the same or a higher parent. Allow permissions defined on lower parents or explicitly on the object being accessed trump deny permissions on higher parents.
—Randy Franklin Smith