To determine a group identifier (GID) to return to a network
file system (NFS) client, Server for NFS first looks at the file
group for the file's security descriptor. (See Understanding the
Windows security descriptor.) It then proceeds in the order
shown in the following list:
If the file group has a GID mapping, that GID is reported.
If the file group does not have a GID mapping, but does have an
entry in the file's discretionary access control list (DACL), the
anonymous GID is reported with the permissions found in the
DACL.