Mike Shellenberger's blog

Navigating the Digital Frontier: End-User Tech Insights

AD Default: Domain Users have rights to add up to 10 workstations to your domain

During one of the Microsoft TechEd sessions I attended this past June in New Orleans, I learned a valuable tidbit of security information related to Active Directory.  By default, every domain user in your active directory has the rights to add up to 10 machines to your domain.  This seems absurd for those of us that have a tightly delegated environment however, certain circumstances warrant this feature.  I won’t get into the circumstances in this post, just how to disable this default feature.

Open a command prompt on a domain controller and type adsiedit.msc.  (In the example screenshots I will be using a Windows Server 2008 R2 domain controller)

Use the connection point “Default Naming Context” if it is not already selected by default.  Right-Click on your domain’s root folder and select Properties

ADSIEdit_AddMachinesQuotaStep1

Scroll down the list of attributes until you find ms-DS-MachineAccountQuota.  Click Edit to modify the value.

ADSIEdit_AddMachinesQuotaStep2

Change the value to 0 to disable regular users from having the rights to join machines to your domain.

ADSIEdit_AddMachinesQuotaStep3

 

*It’s important to note that you should be delegating only a particular set of users the ability to join machines to your domain.  It is not best practice to use an account such as the domain administrator account to bind machines to the domain.  Recommended best practice is to pre-stage the computer accounts in ADUC, then bind the machine using delegated privileges.

Published by

Mike Shellenberger
With over 20 years of experience in implementing and supporting technical solutions, I am passionate about leveraging Microsoft technologies and devices to make a tangible impact on end users. My expertise spans a wide range of Microsoft products, including Windows clients, Intune, Microsoft 365, Windows 365, and Configuration Manager. I have a proven track record in designing, deploying, and managing complex IT infrastructures, ensuring seamless integration and optimal performance. I am dedicated to the digital workspace technology community, where I actively contribute and continuously learn to stay at the forefront of industry advancements. My technical skills also encompass identity/authentication technologies, endpoint security, and cloud computing, enabling me to deliver comprehensive solutions that enhance user productivity and satisfaction. Outside of my professional life, I am an avid homebrewer, amateur radio enthusiast, beekeeper and runner. I enjoy balancing my technical pursuits with these hobbies, which keep me grounded and inspired. I reside in the Lancaster, PA area with my wife and two kids, where we cherish our community and the opportunities it provides.

One response to “AD Default: Domain Users have rights to add up to 10 workstations to your domain”

  1. Michael DeBakey Avatar
    Michael DeBakey

    Very wild, Mike! Thanks for sharing. Any idea what the earliest DFL revision would be to exhibit this property?

    Reply

Leave a comment