Protected Users and protected accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 1353f2d · +2 −0 lines · also on GitHub
⋯ 71 unchanged lines
7272
7373
- To provide domain controller-side restrictions for Protected Users, that is to restrict usage of NTLM authentication, and other restrictions, the domain functional level must be Windows Server 2012 R2 . For more information about functional levels, see [Understanding Active Directory Domain Services (AD DS) Functional Levels](../active-directory-functional-levels.md).
7474
75
+The RID-500 Administrator, as a break-glass account, is always exempted from Authentication Policies enforcement, even when they are assigned to an Authentication Policy Silo.
76
+
7577
### <a name="BKMK_TrubleshootingEvents"></a>Troubleshoot events related to Protected Users
7678
This section covers new logs to help troubleshoot events that are related to Protected Users and how Protected Users can impact changes to troubleshoot either ticket-granting tickets (TGT) expiration or delegation issues.
7779
⋯ 388 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.