I created a new user group - 'customers' and manually added a user. I then edited the group to disable access to a module and it's block. However, when I log-in as that user, I can still see the block and clicking a link in the block takes me to the module page. I tried with the default theme.

Does the module/block permissions only apply to the three primary groups, anonymous, registered and webmaster? Or is it the case that if the registered user group can see a block, then it cannot be hidden in another custom group?

Or am I doing something completely wrong?

(I'm still using 2.0.7.3 at the moment)

O.K. Answered my own question. You can add access priviliges for modules and blocks to a new user group, but not remove them if the 'registered user' group already has them.

So I can let my 'customers' group have access to more modules and blocks than registered users, but not less.

AFAIK

All groups builtin or custom are available to the rights settings. However if a user has access to a block in one group (registered in your case) and not another (customers) they will see the block.

in other words if any of the groups a user belongs to has access to a block then they will see it no matter what other groups you have it turned off.

And an FYI, the initial rights set for any blocks, modules, etc are set to the group rights of the admin that created it. If you are a member of many groups then you'll have a lot of tedious work to turn rights off if you need to. Suggest an admin account with no special group membership other than webmaster/registered.