Securing Computers and Active Directory - Changing the Maximum Number of Computers a User Can Join to the Domain

Problem

You want to grant users the ability to join more or fewer than 10 computers to a domain. This limit is called the machine account quota.

Solution

Using a graphical user interface

1. Open the ADSI Edit MMC snap-in and connect to the Domain Naming Context.
   
2. Right-click on the domainDNS object for the domain you want to change and select Properties.
   
3. Edit the ms-DS-MachineAccountQuota attribute and enter the new quota value.
   
4. Click OK twice.

Using a command-line interface

In the following LDIF code replace <DomainDN> with the distinguished name of the domain you want to change and replace <Quota> with the new machine account quota:

  dn: <DomainDN>
  changetype: modify
  replace: ms-DS-MachineAccountQuota
  ms-DS-MachineAccountQuota: <Quota>
  -

If the LDIF file was named change_computer_quota.ldf, you would then run the following command:

  > ldifde -v -i -f change_computer_quota.ldf

You can also make this change using AdMod, as follows:

  > admod –b <DomainDN> ms-DS-MachineAccountQuota::<Quota>

Using VBScript

  ' This code sets the machine account quota for a domain.
  ' ------ SCRIPT CONFIGURATION ------
  intQuota  = <Quota>
  strDomain = "<DomainDNSName>" ' e.g. emea.rallencorp.com
  ' ------ END CONFIGURATION ---------

  set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
  set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext"))
  objDomain.Put "ms-DS-MachineAccountQuota", intQuota
  objDomain.SetInfo
  WScript.Echo "Updated user quota to " & intQuota

Discussion

In a default Active Directory installation, members of the Authenticated Users group can add and join up to 10 computer accounts in the default Computers container. The number of computer accounts that can be created is defined in the
ms-DS-MachineAccountQuota attribute on the domainDNS object for a domain. The default setting is artificially set to 10, but you can easily change that to whatever number you want, including 0, via the methods described in the Solution section. If you set it to 0, users have to be granted explicit permissions in Active Directory to join computers; refer to Recipe 8.3 for instructions on granting these permissions.

Another method for granting users the right to addcomputerobjects, although not recommended, is via Group Policy. If you grant the “Add workstation to domain” right via Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment on a GPO that’s been linked to the Domain Controllers OU, then users will be able to create computer accounts even if they do not have create child permissions on the defaultComputerscontainer. This is a holdover from Windows NT to maintain backward compatibility and should not be used unless absolutely necessary. In fact, a good security best practice would be to remove this user right from any user or group objects that do not require it.

See Also

Recipe 8.3 for permissions needed to join computers to a domain, MS KB 251335 (Domain Users Cannot Join Workstation or Server to a Domain), and MS KB 314462 (“You Have Exceeded the Maximum Number of Computer Accounts” Error Message When You Try to Join a Windows XP Computer to a Windows 2000 Domain).

Please check back next week for the conclusion to this article.

Comments On: Securing Computers and Active Directory

· This article is an excerpt from the book "Active Directory Cookbook, Second...   >>> Post your comment now!

Buy this book...

This article is excerpted from chapter eight of the Active Directory Cookbook, Second Edition, written by Robbie Allen and Laura E. Hunter (O'Reilly; ISBN: 059610202X). Check it out today at your favorite bookstore. Buy this book now.