Protected Users membership is not a logon

Membership is configuration

A directory query that lists Protected Users returns accounts that are in that group at the time of the query. That is a configuration fact. It does not include a time of a logon, a workstation, or a failure code.

Removing the account from the group later does not rewrite this query. The note should say when you listed the group.

A logon is an event

A logon or a logon failure is an event on a domain controller or a workstation, with its own id and time. Membership does not create that event in your note. If you did not export one, write “no logon event attached.”

Do not say the account cannot sign in, or that a sign-in was stopped, based only on the group list. Those sentences need the event that shows the result.

What to write down

File the account, the group name, and the time you queried. File any logon separately, with its event id and time. Do not put the query time in the logon column.

Lab: a group list read as a blocked logon

A lab query at 11:00 UTC shows lab-ops in Protected Users. No security events were exported. A draft says lab-ops was blocked from signing in at 11:00 because of that membership.

The note says lab-ops was in the group at 11:00, which is the query time. No logon event is attached, so no block is claimed. 11:00 is not a logon time.

query time: 11:00 UTC
account: lab-ops
group: Protected Users
logon events attached: none
write: membership at query time
not: a blocked logon at 11:00