Regarding deny that's correct it overrides all other permissions, but as
usual there always exceptions...

http://www.ntfs.com/ntfs-permissions-precedence.htm

On Tue, Jun 18, 2013 at 1:47 AM, Michael Leone
<Michael.Leone AT pha.phila DOT gov>wrote:

> > My account is a member of the Domain Admin group, which should have
> enough
> > permissions. But I can't even see the "res" directly remotely.
>
> Looking at the permissions of the RES folder, I see that NETWORK is on
> DENY, FULL CONTROL. If I understand it correctly, that means that RES is
> not accessible over a network connection at all. I think. I dunno, I've
> never had to use DENY rights; I've always used combinations of ALLOW ...
>