Test Protected Users for privileged Active Directory accounts to restrict NTLM and credential delegation.
If you are still allowing NTLM for your privileged accounts like Domain Admins, you should know Microsoft introduced hardening for this with Windows Server 2012 R2.
Your privileged accounts should be candidates for the Protected Users group.
Before dropping admins in PUG, please do read the docs and test. No NTLM, no Kerberos delegation, no offline sign-in, and a four-hour Kerberos TGT lifetime may break some things. Accounts need AES keys, and the domain functional level must be Windows Server 2012 R2 or later.
Don’t add all your Domain Admins at once and lock yourself out. Test the actual admin workflows first, and don’t add service or computer accounts.
If it breaks things, use that as a reason to look at how you’re handling privileged identities. Time to build out least privilege.
Original posts: 30 April 2021 and compatibility reminder. Documentation checked 14 October 2026.