Machine account quota should be retrievable
AD-DOM-02InfoActive DirectoryDomain and forest
Part of Active Directory · Active Directory · Domain and forest · All checks
Invoke-Maester -TestId AD-DOM-02Overview
Section titled “Overview”The machine account quota (ms-DS-MachineAccountQuota) attribute controls how many computer accounts a standard (non-administrative) user can join to the domain. The default value of 10 can create security risks:
- Rogue Computer Joins: Attackers with valid user credentials can join unauthorized computers to the domain
- Lateral Movement: Joined computers can be used as pivot points for further attacks
- Resource Exhaustion: Excessive computer accounts can clutter the directory and complicate management
Control Type
Section titled “Control Type”Preventive
Security Recommendation
Section titled “Security Recommendation”Consider reducing the machine account quota to 0 and using alternative methods for computer joins:
- Set quota to 0: Prevents standard users from joining computers
- Use pre-staged accounts: Administrators create computer accounts in advance
- Delegate join permissions: Grant specific groups permission to join computers
- Implement privileged access workstations: Use dedicated admin workstations for domain joins
To modify the quota:
Set-ADDomain -Identity "yourdomain.com" -Replace @{"ms-DS-MachineAccountQuota"="0"}How the Test Works
Section titled “How the Test Works”This test retrieves the current machine account quota value from Active Directory. The test is informational and helps you assess whether the default value poses a risk in your environment.
Related Tests
Section titled “Related Tests”Test-MtAdDomainFunctionalLevel- Retrieves the domain functional levelTest-MtAdDomainControllerCount- Counts domain controllers
Related links
Section titled “Related links”- Microsoft Defender for Identity: Resolve unsecure domain configurations
- ANSSI Active Directory checkpoints: Unrestricted domain join
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DOM-02 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain and forest |
| Area | Access control |
| Resource type | Tenant |
| MITRE ATT&CK | T1136.002 Domain Account |
| PowerShell test | Test-MtAdMachineAccountQuota |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:domainDNS.ms-DS-MachineAccountQuota:ReadProperty |
Source
Section titled “Source”- Test:
tests/ad/domain/Test.AD-DOM-02.ps1 - Documentation:
tests/ad/domain/Test.AD-DOM-02.md