Protected Users Group

🔒 Secure Bits 💡
Want to 𝗹𝗼𝗰𝗸 𝗱𝗼𝘄𝗻 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹 𝘁𝗵𝗲𝗳𝘁 𝗶𝗻 𝗔𝗰𝘁𝗶𝘃𝗲 𝗗𝗶𝗿𝗲𝗰𝘁𝗼𝗿𝘆?

Start using the 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗨𝘀𝗲𝗿𝘀 𝗴𝗿𝗼𝘂𝗽—but only if you understand what it enforces.

𝗛𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝗯𝗲𝗶𝗻𝗴 𝗶𝗻 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗨𝘀𝗲𝗿𝘀 𝗱𝗼𝗲𝘀 𝗯𝘆 𝗱𝗲𝗳𝗮𝘂𝗹𝘁:
✔ Prevents NTLM authentication (no NT hashes ever used)
✔ Disables DES/RC4 encryption in Kerberos pre-auth
✔ Disables CredSSP, Digest, and cached credentials
✔ Forces Kerberos TGTs to 4‑hour lifetime, no renewals
✔ Prevents both constrained and unconstrained delegation
✔ Disallows offline logon—no cached verifier stored
(𝘀𝗲𝗲 𝗳𝘂𝗹𝗹 𝗱𝗲𝘁𝗮𝗶𝗹𝘀 𝗶𝗻 𝘁𝗵𝗲 𝗰𝗼𝗺𝗺𝗲𝗻𝘁𝘀)

🛠 𝗥𝗲𝗾𝘂𝗶𝗿𝗲𝗺𝗲𝗻𝘁𝘀 & 𝗴𝗼𝘁𝗰𝗵𝗮𝘀:
– Domain functional level ≥ Server 2012 R2
– Accounts must support AES keys (reset older passwords if needed)
– Don’t add service/computer accounts—they’ll usually break
– Avoid mass-adding Domain Admins until fully tested

By implementing Protected Users, 𝘆𝗼𝘂 𝘁𝗮𝗸𝗲 𝗿𝗲𝗮𝗹 𝘀𝘁𝗲𝗽𝘀 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 pass-the-hash and credential replay—without extra tools.

How have you handled these limitations in production? Any surprises or workarounds? 👇

Author: Martin Handl – full article: https://iqunit.com/protected-users/