May 2019
Intermediate to advanced
620 pages
21h 41m
English
By default, every user object can be an owner of up to 10 computer objects. This means that every non-admin can join up to 10 devices to a domain. This behavior is governed by the ms-DS-MachineAccountQuota attribute per Active Directory domain.
When this attribute is changed to 0, only user accounts with privileges to add computer objects to the domain are explicitly allowed to join devices to the domain. By default, members of the Domain Admins and Account Operators groups have these privileges, but these privileges can be specifically delegated.
Read now
Unlock full access