You can set up client installation packages with their group membership already defined. If you define a group in the package, the client computer automatically is added to the appropriate group. The client is added the first time it makes a connection to the management server.
You can block a client if you do not want clients to be added automatically to a specific group when they connect to the network. You can block a new client from being added to the group to which they were assigned in the client installation package. In this case, the client gets added to the default group. You can manually move a computer to a blocked group.
To block client computers from being added to groups
In the console, click Clients.
Under Clients, right-click a group, and click Properties.
On the Details tab, under Tasks, click Edit Group Properties.
In the Group Properties for group name dialog box, click Block New Clients.