AD Default: Domain Users have rights to add up to 10 workstations to your domain

During one of the Microsoft TechEd sessions I attended this past June in New Orleans, I learned a valuable tidbit of security information related to Active Directory.  By default, every domain user in your active directory has the rights to add up to 10 machines to your domain.  This seems absurd for those of us that have a tightly delegated environment however, certain circumstances warrant this feature.  I won’t get into the circumstances in this post, just how to disable this default feature.

Open a command prompt on a domain controller and type adsiedit.msc(In the example screenshots I will be using a Windows Server 2008 R2 domain controller)

Use the connection point “Default Naming Context” if it is not already selected by default.  Right-Click on your domain’s root folder and select Properties

ADSIEdit_AddMachinesQuotaStep1

Scroll down the list of attributes until you find ms-DS-MachineAccountQuota.  Click Edit to modify the value.

ADSIEdit_AddMachinesQuotaStep2

Change the value to 0 to disable regular users from having the rights to join machines to your domain.

ADSIEdit_AddMachinesQuotaStep3

 

*It’s important to note that you should be delegating only a particular set of users the ability to join machines to your domain.  It is not best practice to use an account such as the domain administrator account to bind machines to the domain.  Recommended best practice is to pre-stage the computer accounts in ADUC, then bind the machine using delegated privileges.

Advertisements

One response to “AD Default: Domain Users have rights to add up to 10 workstations to your domain

  1. Very wild, Mike! Thanks for sharing. Any idea what the earliest DFL revision would be to exhibit this property?

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s