u-restricted-groups
This specifies a list of groups (from /etc/group) whose members
become restricted users when they login. This can be a comma-delimited
list of group names, or all to restrict all users, or none
to restrict no users. In addition, you can use the all except
sequence to specify that all users except users in the list of groups should
be restricted.
To keep things simple, I recommend creating a special group named restrict,
and in that group, put all the users you want restricted.
Examples:
u-restricted-groups=none
u-restricted-groups=all
u-restricted-groups=restrict
u-restricted-groups=restrict,users,guests
u-restricted-groups=all except admins,operators,wheel
Recommendation:
u-restricted-groups=restrict
