Missing Protected Users Group Membership

Compare a policy-approved roster of human domain users with current recursive membership of the Active Directory Protected Users group, and report roster entries absent from that group. The supplied roster defines who has already been approved for protection; this check does not decide account eligibility or modify group membership. Protected Users imposes non-configurable authentication restrictions, so validate account compatibility before adding users and do not infer that every highly privileged account should be enrolled.