Using the ActiveRoles Server MMC, make a copy of the following built-in access templates, naming and modifying each access template accordingly to be a 'Deny' of the permission:
The above access templates are located in: Configuration | Access Templates | Active Directory | Advanced
The following steps can be used to copy and modify each access template above for 'Deny':
Once you've copied and denied the permissions in each of the above access templates, use the steps in the Administration Guide, Applying Access Templates, to apply the newly created access templates to the appropriate users or groups.
Reference: ActiveRoles Server 6.9 Administration Guide