Protected Users Membership Coverage Audit

Enumerate Domain Admins and Protected Users membership in Active Directory and compare the account names to identify Domain Admins outside Protected Users for a security-control coverage assessment. Membership in Protected Users applies authentication and credential-caching restrictions when members sign in, subject to its prerequisites. A membership gap does not by itself establish DCSync exposure or replication rights; assess those separately.