This keyword can be followed by a number of group names, separated by spaces. Users whose primary group matches one of the patterns aren't allowed to log in. `*' and `?' can be used as wildcards in the patterns. Only group names are valid, a numerical group id isn't recognized. By default login is allowed regardless of the primary group.