Cannot deny Windows domain group permission to access service!

Discussion created by tpcolson on Aug 12, 2013
Using Windows Domain for user and role store, I have added two ACL's to the security setting in ArcGIS manager containing two groups of users whom can access the service (one of the ACL's contains the ArcGIS "Administrators"). The services is pulling from SDE sitting on SQL 2008 R2, which is also using Windows ACL's to control access. There are only about 20 users between the two ACL's. All is 10.1 SP1.

One I publish the service (with no errors or warnings), ANY user in my organization can access the service! What gives here? I checked "Private, available only to selected users" and added the two windows domain groups. Users NOT in the 2 groups cannot access the data through SQL (where the permissions are working correctly), but they can access the feature service and its related map service.