Here’s an example of the policy definition XML for group configuration:
Restrict will replace group membership as the old policy did. With the new policy, we can define a group action: Update or Restrict. With that policy, we did an overwrite (replace) of the current group members. With this new setting, we are able to add members to a local group, which was not possible with the old RestrictedGroups policy. With the upcoming release of Windows 10 20H2, we get a new Policy CSP to manage Local Users and Groups with Microsoft Intune: LocalUsersAndGroups.
