Active Directory Administration Cookbook

How it works...

The Protected Users group is a new feature in Active Directory in Windows Server 2016. Accounts that are members of the group lose the ability to do the following:

• Use cached logons.
• Use outdated authentication protocols, such as NTLM, Digest Authentication, and CredSSP.
• Use weak encryption algorithms, such as DES and RC4, for Kerberos pre-authentication.
• Be delegated as part of both Kerberos Constrained Delegation (KCD) and Kerberos unconstrained delegation.
• Use and renew their Kerberos Ticket Granting Ticket (TGT) for longer than 240 minutes, compared to the default 10-hour validity and 7-day renewal periods.

The preceding protections are non-configurable.

The Protected Users group is ideal for privileged and sensitive ...