windows server 2012 remote desktop lock out attempts

This group provides no local protection to these types of accounts because the password or certificate is always available on the host. Protect users onlyĪccounts for services and computers should not be members of the Protected Users group. When the replication completes, the PDC can be set back to any available Domain Functional Level (if desired), and the Domain Controller-based protections are automatically applied. To do this, promote the Domain Controller holding the Primary Domain Controller emulator (PDCe) Flexible Single Master Operations (FSMO) role to Windows Server 2012 R2, and then allow the upgraded PDC to replicate the Protected Users group to other Domain Controllers. This allows the added security that is achieved by using the Protected Users group to be applied throughout the domain. However, the Protected Users group can be applied to Active Directory domains that are set to a Domain Functional Level (DFL) for an operating system earlier than Windows Server 2012 R2. Take care of server-side requirements (sorta)Īccording to the official documentation, the Protected Users group requires the Windows Server 2012 R2 Domain Functional Level (DFL).

Even if you’ve upgraded all the Domain Controllers to Windows Server 2012 R2 and upgraded the Domain Functional Level to Windows Server 2012 R2, when your colleagues use Windows 7 as their client Operating System (OS) or Windows Server 2008 R2 as their Terminal Servers, they won’t benefit from the protections offered by membership of the Protected Users group.Ģ. No matter how you look at this wonderful feature, you won’t escape the fact that to get the protection, your users need to log on to Windows 8.1 (or up) devices or Windows Server 2012 R2 (or up) hosts. When you want to go and put the Protected Users group to good use in your environment, I feel you should be aware of these things: Interesting stuff, but I feel there’s some things you should know about this feature… You can use it to limit the availability of outdated authentication protocols, weak encryption algorithms and delegation to sensitive user accounts.

With Windows Server 2012 R2 and Windows 8.1, Microsoft introduced a feature in Active Directory Domain Services called the Protected Users group.

Windows server 2012 remote desktop lock out attempts