Glossary
Protected Users group
A built-in Active Directory group whose members get non-configurable protections: no NTLM, no delegation, no cached credentials and short Kerberos TGTs.
Protected Users is a global security group added in Windows Server 2012 R2. Membership applies protections that cannot be turned off per account. On supported clients, credentials are not cached (no cached logon verifier, no WDigest or CredSSP plaintext, no long-term Kerberos keys). At domain functional level Windows Server 2012 R2 or later, members cannot authenticate with NTLM, cannot use DES or RC4 in Kerberos pre-authentication, cannot be delegated, and receive TGTs valid for four hours.
It is intended for human privileged accounts. Service and computer accounts should not be members, because the restrictions break them. Failures are logged in the Microsoft-Windows-Authentication logs on domain controllers, which are disabled by default and must be enabled.