What are protected users?
While this stuff really isn't new to Windows Server 2022,
fine‑grained password policies have been around for many years.
Same with Protected Users.
Protected Users is a built‑in domain global security group that gives
you non‑configurable account protections for members.
Now, there's no members by default.
You would choose the high privilege groups and users to put in there.
For instance, maybe domain admins, enterprise admins.
And some of those non‑configurable protections would be,
for example, disabling the NTLM authentication protocol and requiring Kerberos.
And also speaking of Kerberos,
Protected Users group members cannot have their Kerberos information,
their tickets, and that kind of stuff, cached in‑memory.
Nor can you use those protected users in a delegation scenario using
either Kerberos‑constrained delegation or CredSSP.
So these are pretty strict rules,
but they're by design because the idea is you want to make sure to
minimize the possible attack surface or vulnerability surface of
those high privilege group and user accounts,
you see.
Now,
don't use something like a group Managed Service Account or a computer account.
Don't put those in the Protected Users group because by definition you
may need to rely on delegation with those accounts,
and by putting those accounts into Protected Users,
you're kind of, well,
you're working at cross purposes with the reason why you have the gMSA or a computer account to begin with.