Using the include or exclude symbols

Include
Precede the user attribute expression by a plus (+) sign. All users identified by the expression will be selected, unless they are also selected by an exclude expression. If the first attribute in your definition is an include, it does not need to have a (+) sign defined, because the sign is implicit.

The default (if you specify no user attributes) is to include all users, on all workstations, in all groups, so if you want to define, for example, all users except one named user, you would just supply the exclude definition for the one user.

Exclude
Precede the user attribute expression by a tilde (~) sign. All users identified by the expression will never be selected, regardless of if they are identified by any include expressions.