Let an MDM policy set the groups the daemon sockets are restricted to

docs/netbird.adml

@@ -56,6 +56,8 @@
 
       <string id="SplitTunnel_Name">Split tunnel</string>
       <string id="SplitTunnel_Help">Restrict the NetBird tunnel to or from a chosen list of application package names. Choose either the allow mode (only the listed apps route through NetBird) or the disallow mode (the listed apps bypass NetBird; everything else routes through). The mode is mutually exclusive — only one can be active at a time. Android-only at the daemon level; Windows/macOS/iOS clients ignore this policy.</string>
+      <string id="AllowGroups_Name">Restrict the daemon sockets</string>
+      <string id="AllowGroups_Help">Restrict the NetBird daemon control pipe, and the JSON socket where it is enabled, to the listed principals. Accounts outside them cannot connect at all, so nothing the daemon exposes is reachable from them; LocalSystem and elevated administrators are never locked out. Enter security identifiers in sid:S-1-5-21-... form, comma-separated, because the daemon reads this while starting and must not wait on a domain controller to resolve a name. An empty value lifts a restriction that was set when the service was installed. Windows and macOS only; on macOS the entries are Unix group IDs in gid:1001 form.</string>
       <string id="SplitTunnel_Allow">Allow only listed apps (everything else bypasses)</string>
       <string id="SplitTunnel_Disallow">Disallow listed apps (everything else routes)</string>
 
@@ -101,6 +103,12 @@
         <decimalTextBox refId="WireguardPort_Decimal" defaultValue="51820">WireGuard UDP port:</decimalTextBox>
       </presentation>
 
+      <presentation id="AllowGroups_Pres">
+        <textBox refId="AllowGroups_Text">
+          <label>Allowed SIDs (comma-separated):</label>
+        </textBox>
+      </presentation>
+
       <presentation id="SplitTunnel_Pres">
         <dropdownList refId="SplitTunnel_Mode" defaultItem="0">Mode:</dropdownList>
         <textBox refId="SplitTunnel_Apps">

docs/netbird.admx

@@ -204,6 +204,19 @@
       </elements>
     </policy>
 
+    <policy name="AllowGroups"
+            class="Machine"
+            displayName="$(string.AllowGroups_Name)"
+            explainText="$(string.AllowGroups_Help)"
+            key="Software\Policies\NetBird"
+            presentation="$(presentation.AllowGroups_Pres)">
+      <parentCategory ref="NetBird" />
+      <supportedOn ref="SUPPORTED_NetBird_All" />
+      <elements>
+        <text id="AllowGroups_Text" valueName="AllowGroups" required="false" />
+      </elements>
+    </policy>
+
     <!-- ============================================================ -->
     <!-- UI: visibility / UX kill switches                             -->
     <!-- ============================================================ -->