Given two TFS security groups
- Admins: Contains a set of Windows users
- Friends: Contains a Windows Security Group (which is also used as a mailing list)
However, the people listed as Admins are also part of the Friends security group since the mailing list should reach all the applicable people. It appears that when I lock down the Friends group to certain directories in TFS, the people in Admin also lose their privileges.
Is there any way for users to receive the maximum security allowed between multiple groups they are included in? Or have I perhaps setup my TFS security groups incorrectly?
Update: I've tried changing "deny" to "not allow", but that doesn't seem to help either because without "deny" or "allow" read at the TFS project level, they cannot even see the TFS project when connecting to the server.