If there are multiple errors, the last error is returned at the end of the policy processing. If name/SID lookup fails, the group is skipped and the next group in the XML file is processed. If you specify a name, the LookupAccountName API is used to lookup the group and validate the name.
If you specify a SID, the LookupAccountSid API is used to translate the SID to a valid group name. : Specifies the name or SID of the local group to configure. Here is an example of the policy definition XML for group configuration: Applying both the policies to the same device is unsupported and may yield unpredictable results. Starting from Windows 10, version 20H2, it is recommended to use the LocalUsersandGroups policy instead of the RestrictedGroups policy. However, it allows only for a full replace of the existing groups with the new members and does not allow selective add or remove.
The RestrictedGroups/ConfigureGroupMembership policy setting also allows you to configure members (users or AAD groups) to a Windows 10 local group.
