The fact that an inherited Deny is overrided in AD by an explicit allow is causing me a few headaches. Is there a way in AD to force an inherited deny down through the tree (such as the GPO "no override" option)? Or a 3rd party utility to do such a thing?