Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Protected Users Group in Windows Server 2012 R2 Active Directory
Learn about the new Protected Users domain global group in Windows Server 2012 R2 Active Directory.
Jan De Clercq
July 30, 2014
1 Min Read
Q: What's the purpose of the new Protected Users domain global group in Windows Server 2012 R2 Active Directory?
A: When a user account is added to the Protected Users group, a set of authentication protocol restrictions are applied to the account to better protect it against the compromise of its credentials during the authentication process. Microsoft recommends adding high-value accounts—such as server administrators—to the Protected Users group. The authentication protocol restrictions include the following:
A member of the Protected Users group can sign on only by using the Kerberos protocol. The account can't authenticate using NTLM, Digest Authentication, or CredSSP.
The Kerberos protocol won't use the weaker DES or RC4 encryption types during the Kerberos pre-authentication process.
The user's account can't be delegated through Kerberos constrained or unconstrained delegation.
For more details on this new security group, see the Microsoft TechNet article "Protected Users Security Group."
About the Author(s)
You May Also Like
