Consider the scenario where a protection template locks down group membership of a particular group. This group has nested groups.
Does protecting a group protect the nested groups by means of inheritence or do the nested groups need to be added individually for protection?
AD object protection, when specified for a group, does not protect nested groups. Protection is for that specific group and the selected attributes of that object.
Add all groups required for protection individually in to the AD Protection template.
