Protected Users Group
What is the Protected Users Group
The Protected Users group is designed to help prevent credential theft for users that are the members of it by the implementation of restrictions that cannot be disabled or circumvented (the only way around these restrictions is to remove the user from the Protected Users group).
This makes it a great way to protect privileged accounts that have administrative permissions on critical/secure systems or a large numbers of systems.
Restrictions for Members of the Protected Users Group
Cannot authenticate using NTLM - must authenticate using Kerberos
Credentials are not cached on a client computer - you cannot login to a computer when it is offline or cannot reach a Domain Controller
TGTs expire after 4 hours and cannot be renewed - you must re-authenticate to get a new TGT
Prevents the use of weak cyphers (DES or RC4) for Kerberos encryption - must use AES
Cannot be delegated with unconstrained or constrained delegation
Protected Users at the University
The Protected Users group is being leveraged to address audit findings related to lateral account movement.
Protected Users Group Members in the Austin Domain
Group Members | Member Details |
|---|---|
Domain Admins | Domain Admins (Enterprise Technology staff who administer/manage the domain) |
Department User Accounts | These are User Accounts that are created/managed in the Department User Tools; Department Service Accounts are not included. STATUS UPDATES
TIMELINE:
|
Related Topics - Info, Tips, and Troubleshooting for Members of Protected Users
- Access Denied / Errors Caused by TGT Expiration for Members of the Protected Users Group
- Connecting to SQL Server Remotely - Ensuring Kerberos Can Be Used
- Department User Accounts Added to Protected Users Group Email
- Joining a Computer to the Domain as a Member of Protected Users
- Remote Desktop Gateway - Members of the Protected Users Group Can Not Authenticate
- Remote Desktop - Resolving Issues for Members of the Protected Users Group
Requesting a Security Exception for the Protected Users Group
A Security Exception must be requested from the ISO on https://isora.security.utexas.edu/#compliance in order to have a Department User removed from the Protected Users group.
Security exceptions can only last a year, so you must renew the exception every year that it is needed - otherwise, the user will automatically be added back to the Protected Users group when the exception expires.