An Active Directory Object that is used to manage Access Control Lists (ACL) for members of a Protected Group in Active Directory (AD).
It holds a special Security Descriptor (SD) that is automatically applied, by SDProp, at regular intervals (default 60 min) to any object in these groups.
This means that if an attacker removes or changes permissions on accounts in these groups, the original ACL will be restored at these regular intervals, which can prevent privilege escalation.