为了解决这个问题，可以使用Active Directory对象的有效性验证技术。这个技术会验证ACL中的ACE是否会影响到当前操作，从而避免了被拒绝的ACE对性能的影响。

代码示例：

using System.DirectoryServices;

...

DirectoryEntry entry = new DirectoryEntry("LDAP://CN=TestObject,OU=TestOU,DC=example,DC=com");

...

ActiveDirectorySecurity security = new ActiveDirectorySecurity();

DirectorySecurity dirSecurity = entry.ObjectSecurity;

security.SetSecurityDescriptorSddlForm(dirSecurity.GetSecurityDescriptorSddlForm(AccessControlSections.All));

AuthorizationRuleCollection authRules = security.GetAccessRules(true, false, typeof(NTAccount));

if (authRules.Count > 0)

{

AuthorizationRuleCollection denyRules = new AuthorizationRuleCollection();

foreach (AuthorizationRule rule in authRules)

{

if (rule.AccessControlType == AccessControlType.Deny)

{

denyRules.Add(rule);

}

}

security.PermittedOnlyAces = true;

security.AddAccessRules(denyRules);

...

}