Hi,
a following fix has been deployed to all EMEA portals already and will be deployed to Apac and Amer portals during today:
You cannot assign Server Protection profile for a server that has domain controller role. Profile actually gets delivered to device, but portal UI will never change out of the pending state and it shows the previous profile.
PSB Team