[WAR]

I never meant to imply that it worked any way other than what you intended. It is an exceptionally well-written hack. For my own purposes though, I need it to work a different way, I just wanted to have you look over what I did above for a sanity check.

Thanks for clarifying the issue with the ()'s and the individually specified users, it makes much more sense that what I had assumed was going on.

If the hack would give access due to that users belonging to another usergroup, it would be impossible to ban primary usergroups as their users might get access due to secondary usergroups which they join themselves.

This is why vbulletin lets you designate a primary usergroup to not allow inherited permissions from any secondary groups for its in-built group permissions.

Again, this is an incredible hack, many thanks for sharing!