Active Directory Coding
The Deny ACE That Never Fires: Non-Canonical ACL Order in Active Directory
Most people who work with Active Directory ACLs know that Deny should come before Allow, and that explicit permissions take precedence over inherited ones.