Today I wrote on the Group Policy team blog about AGPM 3.0 and how its not preserving all the Deny ACE's into the AGPM archive that are applied to the GPO's that you might have set in GPMC. If youre interested even in a side discussion in GP security filtering, I wrote all about it there.