Tools · Active Directory defense · 22 / 23
What is ms-DS-MachineAccountQuota and why you should set it to 0
Learn why default AD lets any user create ten computer accounts, how that enables several attack chains, and how to delegate computer joins properly.
The default
ms-DS-MachineAccountQuota on the domain root defaults to 10. It lets any authenticated user create up to ten computer accounts in the domain, originally to let users join their own machines. A computer account is a real security principal that can authenticate and request tickets.
Several known escalation chains, including some involving resource-based constrained delegation and certificate templates for computers, start with an attacker creating a computer account they control.
Check and change
Read the attribute on the domain root. Set it to 0 and delegate the “Create Computer objects” right on specific OUs to the groups that legitimately join machines, such as a deployment service account or desktop support.
Find computer accounts created by ordinary users by checking ms-DS-CreatorSID, which is set when a user creates a computer through the quota.
Get-ADObject (Get-ADDomain).DistinguishedName -Properties ms-DS-MachineAccountQuota | Select ms-DS-MachineAccountQuota
Set-ADDomain -Identity (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'=0}
Get-ADComputer -Filter * -Properties ms-DS-CreatorSID, whenCreated | Where-Object { $_.'ms-DS-CreatorSID' } | Select Name, whenCreated, @{n='Creator';e={(New-Object System.Security.Principal.SecurityIdentifier $_.'ms-DS-CreatorSID').Translate([System.Security.Principal.NTAccount])}}Lab: before and after
As a normal lab user, add a computer account with New-ADComputer if the ActiveDirectory module is available, or by joining a spare VM. Confirm it works with the default quota. Set the quota to 0, try again, and observe the access denied error. Then delegate Create Computer objects on the Workstations OU to a Desktop Support group and join a machine as a member of that group.
Watch Event 4741 “A computer account was created” on the DC and alert on creators outside the delegated groups.
New-ADComputer -Name LABTEST01 -SamAccountName LABTEST01 -Path 'CN=Computers,DC=lab,DC=internal'
Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4741; StartTime=(Get-Date).AddHours(-1)} | Select TimeCreated, Message -First 3Clean up
Review computer accounts created by users. Remove the ones that do not correspond to real managed devices.
Pair this change with the other quick wins: Spooler off on DCs, Recycle Bin on, and LAPS for local admin passwords.
Diagram
Default quota versus delegated joins
Who can create computer accounts.
Who. Any authenticated user.
How many. Ten each.
Risk. Attacker-controlled principals for escalation chains.
Who. Desktop support and deployment accounts.
Where. Only in the Workstations OU.
Monitoring. 4741 from unexpected creators.
Check yourself
1. What is the default ms-DS-MachineAccountQuota?
2. Which event records a computer account being created?
3. How should legitimate computer joins work with quota 0?