This keyword can be followed by a list of group name patterns, separated by spaces.
Login is disallowed for users whose primary group or supplementary group list matches one of the patterns. '*' and '?' can be used as wildcards in the patterns.
Only group names are valid; a numerical group ID is not recognized. By default, login is allowed for all groups.