Protected Users and protected accounts

Settings and overrides named on this page

Registry values, policies and cmdlets the source mentions, with the dated steps that name them. Read the source for the values to set.

• AllowedToAuthenticateFrom
• AllowedToAuthenticateTo
• PowerShellAdd-ADGroupMember

Requirements, exceptions and scope

• Protected UsersRequirementExceptionScopeRecommendation6 conditions9 passages
  PowerShellAdd-ADGroupMember

  Protected Users is a new global security group to which you can add new or existing users. Windows 8.1 devices and Windows Server 2012 R2…

• Requirements for using protected accountsRequirementException1 condition2 passages
• Troubleshoot delegation issuesRequirement3 conditions1 passage
• Provide DC-side protections for services and computersRequirementExceptionRecommendation2 conditions5 passages
• OverviewRequirement2 passages
• Restrict a user account to specific devices and hostsRecommendation1 passage
• Configure domain controller supportRequirement1 passage
• Create a user account audit for authentication policy with ADACRequirementException2 conditions3 passages
• Add computer account or group conditionsException1 condition1 passage
• Add computer claim conditionsExceptionRecommendation1 condition2 passages
• Troubleshoot missing computer claimsException2 conditions2 passages
• Configure Dynamic Access Control support on devices and hostsException1 condition1 passage
  AllowedToAuthenticateFromAllowedToAuthenticateTo
• Use the Authentication Policy Failures - Domain Controller administrative logScope1 passage
• Authentication policy silosRequirementException4 conditions5 passages

Extracted automatically from Microsoft's wording. Confirm dates, conditions and whether they apply to you in the source before acting; a month or quarter is a window, not a day.

How this timeline changed

Changes between ChangeIntel's readings of the page, between commits of its source file where Microsoft publishes it, in Internet Archive copies of pages that keep no other history, and entries from Microsoft's own change log (dated as Microsoft dates them). Edits between readings that neither records are unknown.

1. 9 Jul 2025
   Requirement added Requirements for using protected accountsMicrosoft's source, commit 2b47373
2. 9 Jul 2025
   No longer on the page Requirements for using protected accountsMicrosoft's source, commit 2b47373
3. 9 Jul 2025
   Requirement added Configure domain controller supportMicrosoft's source, commit 2b47373
4. 9 Jul 2025
   No longer on the page Configure domain controller supportMicrosoft's source, commit 2b47373
5. 9 Jul 2025
   Requirement added OverviewMicrosoft's source, commit 2b47373
6. 9 Jul 2025
   No longer on the page OverviewMicrosoft's source, commit 2b47373
7. 9 Jul 2025
   Requirement added Protected UsersMicrosoft's source, commit 2b47373
8. 9 Jul 2025
   No longer on the page Protected UsersMicrosoft's source, commit 2b47373
9. 9 Jul 2025
   No longer on the page Requirements for using protected accountsMicrosoft's source, commit 2b47373
10. 9 Jul 2025
    Requirement added Requirements for using protected accountsMicrosoft's source, commit 2b47373
11. 9 Jul 2025
    Scope added Use the Authentication Policy Failures - Domain Controller administrative logMicrosoft's source, commit 2b47373
12. 9 Jul 2025
    No longer on the page Use the Authentication Policy Failures - Domain Controller administrative logMicrosoft's source, commit 2b47373