Summary: in the policy you can edit it anywhere you like but note that if that group is not present on the machine you are editing on only the SID will be displayed The policy works regardless Figure 5 Editing a group that is not resolvable on the local machine in this case Power Users on a Domain Controller So what about entering the SIDs directly into the Restricted Groups
Image Dimensions: 367 x 451
Image originally found here.