Leveraging the Protected Users group

This recipe shows how the Protected Users group can be used to protect privileged and sensitive accounts.

Getting ready

To use the Protected Users group, make sure the domain runs the Windows Server 2012 R2 DFL, or a newer version of the level. Also, be aware that the protections offered by the Protected Users group only apply when accounts that are members of the group are used on devices running Windows 8.1 or newer, Server 2012 R2 or newer.

To manage the Protected Users group, sign into a domain controller or a member server and/or device with the RSAT for Active Directory Domain Services installed. Sign in with an account that is a member of the Domain Admins group, the Account Operators...