I came across the question, if we can use a "Deny ACE" in Active Directory to restrict access to an OU for certain users. In the back of my brain something calls "Deny ACE is more cost expensive in terms of performance than Allow ACE". Unfortunately, I can't find any Microsoft document or something else that underlines this statement.
Does anyone know if there is an actual performance impact or just a false memory of mine?
Any hints are highly appreciated.