[Bug]: Delegation might be limited by Protected Users Group too

[aseques]

Bug Description

Since windows 2012r2 there's a group called Protected Users that, when added to the user adds some security restrictions. It's recommended that the admins are part of this group (since they're not supposed to be running regular software)

The Test-PasswordQuality is adding those users in the block "These administrative accounts (current or former ones) are allowed to be delegated:"

Documentation

• Docs about current state of the setting https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/how-to-configure-protected-accounts
• The protected group documentation here

Steps to Reproduce

• Member of admin group
• Member of protected users group
• Not having checked the "Account is sensitive and cannot be delegated" setting

Expected Behavior

Account should be safe from Delegation attacks, so there shouldn't be any warnings in the block "These administrative accounts (current or former ones) are allowed to be delegated"

Actual Behavior

Users in the protected group are in the warning

Stack Trace

DSInternals Module Version

6.4

PowerShell Version

7.5.4

Operating System

Microsoft Windows Server 2025 Datacenter

Target Domain Controller Version

Microsoft Windows Server 2025 Datacenter

Processor Architecture

x64

Checklist

• I have searched the existing issues to make sure this bug has not already been reported.
• I have tested with the latest version of the DSInternals PowerShell module.

[MichaelGrafnetter]

Hello @aseques , this is a known issue and I am not aware of a good solution to it. The Test-PasswordQuality cmdlet only receives user account objects, which do not contain group membership. Implementing Protected Users group membership retrieval from ntds.dit and especially over MS-DRSR would be quite challenging, considering linked-value replication, recycle bin, and expiring membership features of AD.

The current recommendation/workaround is to just set the "not delegated" flag on all Protected Users members, to make various auditing tools, including DSInternals, happy. This could easily be scripted. I know this is sub-optimal.

[aseques]

Thanks for your reply @MichaelGrafnetter it's complicated indeed, at least it's now documented here in case someone happens to have the same issue.