When attempting to change the scope of a Protection template from "This Object only" to "This object and child objects only", the change appears successful but the scope changes to "This object and ALL child objects" when Protection template is re-opened.
This behavior is only observed when Protection is stored in Active Directory (rather than SQL).
Consider the below scenario:
Create a new template that matches the original Protection template except with a scope of "This object and child objects only".
Waiting for fix in a future release of Change Auditor.