Protected Users: Not a silver bullet against lateral movement

The idea of this post came from a discussion with a client, when he told me that he will keep using members of the Domain Admins group to administer all his servers, as they also will be members of...