From [MSDN](http://msdn.microsoft.com/en-us/library/windows/desktop/aa374868\(v=vs.85\).aspx)

```
The following steps describe the preferred order:
* All explicit ACEs are placed in a group before any inherited ACEs.
* Within the group of explicit ACEs, access-denied ACEs are placed before access-allowed ACEs.
* Inherited ACEs are placed in the order in which they are inherited. ACEs inherited from the child object's parent come first, then ACEs inherited from the grandparent, and so on up the tree of objects.
* For each level of inherited ACEs, access-denied ACEs are placed before access-allowed ACEs.
```