thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Systems & Data Center · Advanced

Protected Users Group

An AD security group whose members get hardened credential protections such as no NTLM, no DES or RC4 Kerberos, and no credential caching.

Definition

Members' Kerberos TGTs have a 4-hour lifetime and cannot be delegated. It is intended for privileged human accounts, not service or computer accounts, which may break.

Example

Adding Domain Admins accounts to Protected Users blocks NTLM authentication for them.

Exam tip

Do not add service accounts or computers to Protected Users; they are likely to fail authentication.

Related terms