AD-DOM-02: Machine account quota should be retrievable


ID	`AD-DOM-02`
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain and forest
Security area	Access control
Resource type	Tenant
MITRE ATT&CK	T1136.002
Reads from	On-premises Active Directory

What this checks and how to fix it

The machine account quota (ms-DS-MachineAccountQuota) attribute controls how many computer accounts a standard (non-administrative) user can join to the domain. The default value of 10 can create security risks:

Rogue Computer Joins: Attackers with valid user credentials can join unauthorized computers to the domain
Lateral Movement: Joined computers can be used as pivot points for further attacks
Resource Exhaustion: Excessive computer accounts can clutter the directory and complicate management

Control Type

Preventive

Security Recommendation

Consider reducing the machine account quota to 0 and using alternative methods for computer joins:

Set quota to 0: Prevents standard users from joining computers
Use pre-staged accounts: Administrators create computer accounts in advance
Delegate join permissions: Grant specific groups permission to join computers
Implement privileged access workstations: Use dedicated admin workstations for domain joins

To modify the quota:

Set-ADDomain -Identity "yourdomain.com" -Replace @{"ms-DS-MachineAccountQuota"="0"}

How the Test Works

This test retrieves the current machine account quota value from Active Directory. The test is informational and helps you assess whether the default value poses a risk in your environment.

Test-MtAdDomainFunctionalLevel - Retrieves the domain functional level
Test-MtAdDomainControllerCount - Counts domain controllers

Mito check. Author: soulemike. Open-source licences.

Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).