From the Field: Protected Users

🔎𝗙𝗿𝗼𝗺 𝘁𝗵𝗲 𝗙𝗶𝗲𝗹𝗱: Real-World Findings from Security Assessments

💥𝟲𝟲.𝟳% of infrastructures I analyzed 𝗱𝗼 𝗻𝗼𝘁 𝗽𝗿𝗼𝘁𝗲𝗰𝘁 𝘁𝗵𝗲𝗶𝗿 𝗽𝗿𝗶𝘃𝗶𝗹𝗲𝗴𝗲𝗱 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝘀 on the Active Directory level.

This is a 𝗰𝗿𝗶𝘁𝗶𝗰𝗮𝗹 𝗴𝗮𝗽 — and one that’s surprisingly 𝗲𝗮𝘀𝘆 𝘁𝗼 𝗳𝗶𝘅.

One of the most underrated ways to harden privileged accounts is by using the 𝗣𝗿𝗼𝘁𝗲𝗰𝘁𝗲𝗱 𝗨𝘀𝗲𝗿𝘀 group in Active Directory.

𝗪𝗵𝗮𝘁 𝗱𝗼 𝘆𝗼𝘂 𝗴𝗮𝗶𝗻?

❌ NTLM authentication is blocked — no NT hashes stored in memory

❌ Plaintext passwords are not cached (Wdigest & legacy delegation)

❌ No delegation allowed

✅ TGTs have limited lifetime

✅ Kerberos-only authentication (safer by design)

(check the whole list in the documentation)

𝗬𝗲𝘀, 𝘁𝗵𝗲𝗿𝗲 𝗮𝗿𝗲 “𝗹𝗶𝗺𝗶𝘁𝗮𝘁𝗶𝗼𝗻𝘀”:

❌ You can’t authenticate over IP (NTLM fallback won’t work)

❌ Some legacy apps or services may not support Protected Users

But the trade-off is worth it. This is 𝗹𝗼𝘄-𝗲𝗳𝗳𝗼𝗿𝘁, 𝗵𝗶𝗴𝗵-𝗶𝗺𝗽𝗮𝗰𝘁 hardening — and one of the simplest ways to raise the bar for attackers.

👉 If you haven’t already — audit your privileged accounts and consider moving them under the protection of this group.