Best practise when using AD Protection Template with user objects (4255514)

It is not recommended to use AD Protection templates with normal user accounts as this could prevent users from performing normal actions such as changing their password.

When protecting user objects, the template should be configured to protect just the attributes required, not all of the objects attributes. Do not protect attributes which are generally controlled and modified by AD or normal operations in AD such as the badPasswordCount attribute, lockoutTime attribute, etc