Resolving access conflicts
What if a user is granted access but the group
they belong to is denied access? Or if the user
belongs to ten groups, nine of which has access
and one of which doesn’t?
NT checks the ‘Deny’ list first and stops looking
as soon as it finds a hit.