Deny groups

This keyword can be followed by a list of group name patterns, separated by spaces.
Login is disallowed for users whose primary group or supplementary group list matches one of the patterns. '*' and '?' can be used as wildcards in the patterns.
Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups.

Specify a list of rescue users (enter the comma-separated user or group names, e.g. [email protected], [email protected], or use * to include all AD users):

Registry Hive	HKEY_LOCAL_MACHINE
Registry Path	Software\Policies\Centrify\ssh
Value Name	ssh.denygroups.enabled
Value Type	REG_DWORD
Default Value