FYI : If you use DENY then whoever are into that group lost SQL Server level access for that particular SQL Server even though they are in some other group which has DB reader etc.. permission on some database on same server . and You end up with error 18456....