exclude protected user