Remember that a Windows user might be a member of more than one Windows group (e.g. both Engineers, and Managers). Permissions granted or denied to the Engineers login, to the Managers login, granted or denied to the user individually, and granted or denied to roles that the user is a member of, will all be aggregated and evaluated to for the effective permissions.
If windows group is added as login and given db_owner permission on couple of dbs.
And then one of the members of this group (say domainname\UserA) is added as a login with only public role (at server and db level).
I know that denials override the grants. But does giving public permission inherently result in any denials?
In other words, what is the effective permission for this user (domainname\UserA)? Is it only public or does it retain the db_owner permissions?