In most aid it is deployments.
Some security groups are considered as security critical Windows Server 2016 or later.
Peru whites.
The restricted groups feature and the protected to users security groups feature to provide additional
potential for these groups restricted groups for security critical local groups on servers or workstations
you can use the restricted group's functionality available in group policy to control membership in
these groups and memberships of these groups restricted groups allow you to select a local security
group and defined two attributes members and member of men defined their members attribute you specify
who should and should not belong to the restricted group being configure when you configure the members
attribute any current member of a restricted group that is not listed as member is removed automatically
with the exception of the administrator and the administrator is group additionally and a user that
is listed as member who is not currently a member of the restricted group is added automatically when
you use the member of attribute of a restricted group make sure that the restricted group is a member
of groups that are listed in the member of text books you can not use this attribute to remove the restricted
group from any other group to configure restricted groups Open Group Policy Management Editor and navigate
to the computer configuration policies windows sentence security settings node an example of when you
might want to use restricted groups is if you want to control membership in the local administrator
group on your organization's workstations.
Please note that you can not use this feature to manage domain groups in 80 Days.
You must use the restricted restricted groups feature only with local groups on client or server computers.
Now let's talk about protected users security groups in the summer 2012.
Our 2 introduced the protected to users Security Group which generates non configurable protection on
devices and computers that are run on Windows Server 2012 R2 on your operating systems.
Domain Controllers and domains with a primary domain controller that are run on Windows Server 2012
R2 or newer.
This substantially reduces the memory footprint of credentials when users sign in to computers on the
network from an uncompromised computer.
Consider the following points when the user and protected Users Group the protected users group membership
can not authenticate by using A.L. lamb or digest authentication or credential security support support
provider which is an authentication mechanism also known as great as a spear on do ISIS run and Windows
8 dot 1 and newer passwords are not cached so the device that uses anyone of these security support
provider or SSP will fail to authenticate a domain when the account is part of the protected user group.
Another point is the Burrus protocol which will not use the weaker data encryption standard tor D E
S or our C4 encryption types in the pre authentication process.
Therefore you must configure the domain to support at least the enhanced security encryption standard
cipher sued or a e s cipher sued.
Another point is that you can not delegate the user's account with Gerber as constraint or unconstrained
delegation.
This can cause for more connections to other systems to fail if the user is in the protected user group.
Another point is the default Cobra's TGT is lifetime sentence of four hours is configure is configurable
by using authentication policies and silence which you can access through the active directory administrative
center.
This means that the user must authenticate again after four hours.
Next up we'll be talking about fine grained password and log out policies.
I'll see you there.