Find users in a domain that have the protected attribute that should not, remove that attribute and re enable inheritance.

ProtectedAttributeCleanup.ps1

#requires -Modules ActiveDirectory

# Gets all currently protected groups and users.
$protectedGroups = Get-ADGroup -LDAPFilter '(adminCount=1)'
$protectedUsers = Get-ADUser -LDAPFilter '(adminCount=1)'

# Gets all the users that are actually members of the current protected groups.
$usersFromProtectedGroups = $protectedGroups | ForEach-Object {
    Get-ADGroupMember -Identity $_ | Where-Object {
        $_.ObjectClass -eq 'User'
    }
}

# Build arrays for users that should be protected, and for users that should not be protected.
$trueProtectedUsers = @()
$falseProtectedUsers = @()
foreach ($user in $protectedUsers) {
    if ($usersFromProtectedGroups -match $user) {
        $trueProtectedUsers += $user
    } else {
        $falseProtectedUsers += $user
    }
}

# Remove the flag from users that are not members of the protected groups, and enable inheritance.
foreach ($falseUser in $falseProtectedUsers) {
    Set-ADUser -Identity $falseUser -Clear {AdminCount}

    if (($acl = Get-Acl -Path AD:\$falseUser).AreAccessRulesProtected) {
        $acl.SetAccessRuleProtection($false, $true)
        Set-Acl -AclObject $acl -Path AD:\$falseUser
    }
}