SPP can check the password of AD users with the connected service user. But if I add the AD user to the Protected Users group in the AD I get a error for password check. Password change still works. How does SPP check the password against AD? Is it by hash or login attempt? Is there additional rights in the AD necessary for the service user?
