Please check the CIFS manual (and Microsoft Literature):

"Support for restricted groups
Restricted groups are GPO security settings that allow the administrators to easily define
and control the default membership for security-sensitive groups. Restricted groups are
primarily used to configure the membership of local groups on a workstation or member
servers of the domain.
Restricted groups define two properties:
◆ Members - The Members list defines who belongs and who does not belong to the
restricted group. When a restricted groups policy is enforced, any current member of a
restricted group who is not on the Members list is removed. Any user on the Members
list who is not currently a member of the restricted group is added.
◆ MemberOf - The MemberOf list ensures that the restricted group is added to the groups
listed under the MemberOf property. It does not remove the group from the other groups
of which it is a member.
Note: Restricted groups are automatically applied after the CIFS service is started.
Delegating joins"