Changing the Maximum Number of Computers a User Can Join to the Domain

Changing the Maximum Number of Computers a User Can Join to the Domain

Problem

You want to grant users the ability to join more or fewer than 10 computers to a domain. This limit is called the machine account quota.

Solution

Using a graphic al user interface

Using a command-line interface

In the following LDIF code replace <DomainDN> with the distinguished name of the domain you want to change and replace <Quota> with the new machine account quota:

	dn: <DomainDN>
	changetype: modify
	replace: ms-DS-MachineAccountQuota
	ms-DS-MachineAccountQuota: <Quota>
	-

If the LDIF file was named change_computer_quota.ldf, you would then run the following command:

	> ldifde -v -i -f change_computer_quota.ldf

You can also make this change using AdMod, as follows:

	> admod b <DomainDN>  
ms-DS-MachineAccountQuota::<Quota>

Using VBScript

	' This code sets the  
machine account quota for a domain.
	' ------ SCRIPT CONFIGURATION ------
	intQuota = <Quota>
	strDomain = "<DomainDNSName>" ' e.g. emea.rallencorp.com
	' ------ END CONFIGURATION --------

	set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE")
	set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext"))
	objDomain.Put " 
ms-DS-MachineAccountQuota", intQuota
	objDomain.SetInfo
	WScript.Echo "Updated user quota to " & intQuota

Discussion

In a default Active Directory installation, members of the Authenticated Users group can add and join up to 10 computer accounts in the default Computers container. The number of computer accounts that can be created is defined in the ms-DS-MachineAccountQuota attribute on the domainDNS object for a domain. The default setting is artificially set to 10, but you can easily change that to whatever number you want, including 0, via the methods described in the Solution section. If you set it to 0, users have to be granted explicit permissions in Active Directory to join computers; refer to Recipe 8.3 for instructions on granting these permissions.

Another method for granting users the right to add computer objects, although not recommended, is via Group Policy. If you grant the "Add workstation to domain" right via Computer Configuration Windows Settings Security Settings Local Policies User Rights Assignment on a GPO that's been linked to the Domain Controllers OU, then users will be able to create computer accounts even if they do not have create child permissions on the default Computers container. This is a holdover from Windows NT to maintain backward compatibility and should not be used unless absolutely necessary. In fact, a good security best practice would be to remove this user right from any user or group objects that do not require it.

See Also

Recipe 8.3 for permissions needed to join computers to a domain, MS KB 251335 (Domain Users Cannot Join Workstation or Server to a Domain), and MS KB 314462 ("You Have Exceeded the Maximum Number of Computer Accounts" Error Message When You Try to Join a Windows XP Computer to a Windows 2000 Domain)