When running PingCastle in a domain that has over 1500 members in Protected Users, the tool stops at 1499 users. The issue here is that the first 1499 members of the group is counted, where the problem is that the rest of the members is regarded as they aren't members. The members in the Protected Users group are both normal users and admins.
The rule P-ProtectedUsers then reports that some admins are not in the Protected Users group, when they in reality are members of the group.
When running PingCastle in a domain that has over 1500 members in Protected Users, the tool stops at 1499 users. The issue here is that the first 1499 members of the group is counted, where the problem is that the rest of the members is regarded as they aren't members. The members in the Protected Users group are both normal users and admins.
The rule P-ProtectedUsers then reports that some admins are not in the Protected Users group, when they in reality are members of the group.