jumbotron

You can help the content reach more people by sharing this website on social media.


Fırat Boyan 01.10.2020 0

Changing ms-DS-MachineAccountQuota Attribute Limit in Windows Server 2019

A user with a standard Active Directory User Account in Windows Server 2019 has the right to join 10 computers to the domain by default. This may pose a security risk for some organizations. I will be mentioning you how you can change the default value of this limit for a standard Active Directory user in this essay.

We can intervene in the ms-DS-MachineAccountQuota Attribute from two points one of which is ADSI.EDIT and the other one is Powershell.

2- Changing ms-DS-MachineAccountQuota Attribute with Powershell

To change the ms-DS-MachineAccountQuota Attribute through ADSI Edit;

1.1- I am right clickin on ADSI Edit and then clicking on Connect to... option.

ms-DS-MachineAccountQuota

1.2- I am selecting the Default naming context option in the Connection Settings window and clicking on the  OK button.

ms-DS-MachineAccountQuota

1.3- I am right clicking on firatboyan.com Distinguished Name and selecting the Properties option.

ms-DS-MachineAccountQuota

1.4- In the window that opens, I am reaching the ms-DS-MachineAccountQuota Attribute under the Attribute Editor and double click on it.

ms-DS-MachineAccountQuota

1.5- When we double click on the MachineAccountQuota Attribute, we can change the value. The number 10 here is the value information that a user with a standard Active Directory User Account has the right to be able to join 10 computers by default. This value can be increased or decreased from this area.

ms-DS-MachineAccountQuota

2- Changing ms-DS-MachineAccountQuota Attribute with Powershell

To change the ms-DS-MachineAccountQuota Attribute through Powershell;

2.1- I am typing the Powershell command of Get-ADObject in the Powershell console as follows.

Get-ADObject -Identity ((Get-ADDomain).distinguishedname) -Properties ms-DS-MachineAccountQuota

ms-DS-MachineAccountQuota

2.1.1- As a result; ms-DS-MachineAccountQuota is the value information that a user with a standard Active Directory User Account has the right to join 10 computers to the domain by default.

2.1- To change the default value of 10, I am typing the Powershell command of  Set-ADdomain  in the Powershell console as follows. I am changing the value 10 to 0 (zero) in my example.

Set-ADdomain -Identity -Replace @{"ms-DS-MachineAccountQuota"="0"}

ms-DS-MachineAccountQuota

3- After changing the ms-DS-MachineAccountQuota Attribute from the Powershell console, when I reach the ms-DS-MachineAccountQuota Attribute on ADSI Edit, we can see that the value I changed on Powershell also had changed in this field.

ms-DS-MachineAccountQuota

It is also possible for you to watch related video content of this essay through Changing ms-DS-MachineAccountQuota Attribute Limit in Windows Server 2019.

I hope it benefits....


You may submit your any kind of opinion and suggestion and ask anything you wonder by using the below COMMENT form.



You can help the content reach more people by sharing this website on social media.

Author: Fırat Boyan

My name is Fırat Boyan. I was born in Alanya, which is one of the counties of the Antalya city, in 1985. I am a Senior System Engineer, IT Trainer (MCT) and a Sworn Translator from English into Turkish and from Turkish into English affiliated with a Notary Office.  I have been living in Istanbul since 2008 and providing service in the field of Information Technologies for 18 years. I currently work for Data Market as a Senior Cloud Engineer and I have been providing System and Network trainings as an MCT-Microsoft Certified Trainer affiliated with Network Akademi, which is the most leading educational institution rendering trainings of Information Technologies. I also provide IT Consultancy Services for corporate companies on an individual basis. Please visit the page About Me to get more detailed information about me and to review the Microsoft certifications I have.


COMMENTS
No comment made for this video yet! Be the first to make comment.
You may submit your any kind of opinion and suggestion and ask anything you wonder by using the below comment form.

   
   
  You may type 750 characters.
 
Please, enter the verification code with UPPER-CASE letters.
* Comments are published after being approved.
* E-mail is required for comment approval notification, not published.