Protected Users and protected accounts
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 6321150 · +2 −1 lines · also on GitHub
⋯ 71 unchanged lines
7272
7373
- To provide domain controller-side restrictions for Protected Users, that is to restrict usage of NTLM authentication, and other restrictions, the domain functional level must be Windows Server 2012 R2 . For more information about functional levels, see [Understanding Active Directory Domain Services (AD DS) Functional Levels](../active-directory-functional-levels.md).
7474
75
−The RID-500 Administrator, as a break-glass account, is always exempted from Authentication Policies enforcement, even when they are assigned to an Authentication Policy Silo.
75
+> [!NOTE]
76
+> The builtin domain Administrator (`S-1-5-<domain>-500`) is always exempt from Authentication Policies, even when they are assigned to an Authentication Policy Silo.
7677
7778
### <a name="BKMK_TrubleshootingEvents"></a>Troubleshoot events related to Protected Users
7879
This section covers new logs to help troubleshoot events that are related to Protected Users and how Protected Users can impact changes to troubleshoot either ticket-granting tickets (TGT) expiration or delegation issues.
⋯ 389 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 09:08 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.