[Tfug] Ideas for handling group based allow/deny permissions?

[Choprboy]

On Wednesday 23 June 2004 19:03, Iketo wrote:
> May I point out a (im)perfect example?  Win2000 Networking permissions &
> NTFS Permissions.
> 
> Both basically state if an implicit deny, you are not allowed access (Group
> B is not allowed to access Group A do to an implicit deny). 

And what about when a user is a member of both Group A and B? That user is 
denied from all of Group A's objects because he's also part of Group B 
(whereas he was put into Group A because he also does Group A stuff). That's 
the problem I'm dealing with...