Attempting to login or join the domain fails when user is a member of the Active Directory Protected Users Group

 Symptoms

• Attempting to join an ESXi host or VCSA to the domain fails
• Attempting to add an ldap Identity Source fails
• Attempting to login with a user account fails
• In the security logs of the domain controller you observe the following Credential Validation Error:

NTLM authentication failed because the account was a member of the Protected User group

Cause

Introduced in Windows Server 2012 R2 domain controllers the Protected Users Security Group by design is inherently restrictive.

"Members of this group automatically have non-configurable protections applied to their accounts. Membership in the Protected Users group is meant to be restrictive and proactively secure by default."

Accounts that are members of the Protected Users group that authenticate to a Windows Server 2012 R2 domain are unable to:

• Authenticate with NTLM authentication.

• Use DES or RC4 encryption types in Kerberos pre-authentication.

• Be delegated with unconstrained or constrained delegation.

• Renew the Kerberos TGTs beyond the initial four-hour lifetime.

Resolution

There is no resolution

Workaround

Utilize a user account outside of the 'Protected Users' Group

Related Information

https://docs.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group