Changing ms-DS-MachineAccountQuota Attribute Limit in Windows Server 2019

A user with a standard Active Directory User Account in Windows Server 2019 has the right to join 10 computers to the domain by default. This may pose a security risk for some organizations. I will be mentioning you how you can change the default value of this limit for a standard Active Directory user in this essay.

We can intervene in the ms-DS-MachineAccountQuota Attribute from two points one of which is ADSI.EDIT and the other one is Powershell.

2- Changing ms-DS-MachineAccountQuota Attribute with Powershell

To change the ms-DS-MachineAccountQuota Attribute through ADSI Edit;

1.1- I am right clickin on ADSI Edit and then clicking on Connect to... option.



1.2- I am selecting the Default naming context option in the Connection Settings window and clicking on the  OK button.

1.3- I am right clicking on firatboyan.com Distinguished Name and selecting the Properties option.



1.4- In the window that opens, I am reaching the ms-DS-MachineAccountQuota Attribute under the Attribute Editor and double click on it.



1.5- When we double click on the MachineAccountQuota Attribute, we can change the value. The number 10 here is the value information that a user with a standard Active Directory User Account has the right to be able to join 10 computers by default. This value can be increased or decreased from this area.

2- Changing ms-DS-MachineAccountQuota Attribute with Powershell

To change the ms-DS-MachineAccountQuota Attribute through Powershell;

2.1- I am typing the Powershell command of Get-ADObject in the Powershell console as follows.

2.1.1- As a result; ms-DS-MachineAccountQuota is the value information that a user with a standard Active Directory User Account has the right to join 10 computers to the domain by default.

2.1- To change the default value of 10, I am typing the Powershell command of  Set-ADdomain  in the Powershell console as follows. I am changing the value 10 to 0 (zero) in my example.

3- After changing the ms-DS-MachineAccountQuota Attribute from the Powershell console, when I reach the ms-DS-MachineAccountQuota Attribute on ADSI Edit, we can see that the value I changed on Powershell also had changed in this field.



It is also possible for you to watch related video content of this essay through Changing ms-DS-MachineAccountQuota Attribute Limit in Windows Server 2019.

I hope it benefits....