The Protected Users security group in Active Directory is specifically designed to strengthen authentication protection for sensitive and highly privileged accounts by having Windows apply a fixed set of hardening restrictions the moment an account becomes a member, without needing any custom Group Policy authoring or additional infrastructure. Members of Protected Users cannot authenticate by using NTLM, Digest authentication, or CredSSP at all, and their credentials are not cached on the computers they sign into in the same persistent way that ordinary user credentials are, directly satisfying the requirement to prevent cached credentials and legacy protocols from being used by these accounts. Kerberos authentication for Protected Users members is also hardened at the same time by preventing the use of weaker encryption types such as DES and RC4 and by disabling the ability to use a long-lived Kerberos ticket-granting-ticket renewal, further reducing the account ' s exposure to credential theft techniques such as pass-the-hash and pass-the-ticket attacks. The existing Windows Server 2016 domain functional level in this environment is already fully sufficient to support Protected Users functionality, so raising the functional level would accomplish nothing toward this goal. Enabling reversible password encryption would weaken credential security rather than improve it, and while an authentication policy silo is useful for restricting where specific privileged accounts are permitted to authenticate, it does not by itself provide the complete set of credential-caching and legacy-protocol protections that Protected Users membership delivers directly.