The Protected Users security group was introduced with Windows Server 2012 R2 and continued in Windows Server 2016. This group was developed to provide highly privileged accounts with better protection from credential theft attacks. Members of this group have non-configurable protection applied. In order to use the Protected Users group, Primary Domain Controller (PDC) should be running with a minimum of Windows Server 2012 R2 and the client computers should be running with a minimum of Windows 8.1 or Windows 2012 R2.
If a member of this group logs in to Windows 8.1, Windows Server 2012 R2, Windows 10, or Windows Server 2016, then we can expect the following:
- Members of this group cannot use NTLM, digest ...
