The Deny ACE That Never Fires: Non-Canonical ACL Order in Active Directory

Most people who work with Active Directory ACLs know that Deny should come before Allow, and that explicit permissions take precedence over inherited ones.