ad-adds-machineaccountquota.md (3421B)
1 --- 2 title: "Active Directory - Machine Account Quota" 3 section: "Active Directory" 4 sectionSlug: "active-directory" 5 sourcePath: "docs/active-directory/ad-adds-machineaccountquota.md" 6 sourceUrl: "https://github.com/swisskyrepo/InternalAllTheThings/blob/203bb0c0b290/docs/active-directory/ad-adds-machineaccountquota.md" 7 sha: "203bb0c0b290" 8 isIndex: false 9 --- 10 11 # Active Directory - Machine Account Quota 12 13 In Active Directory (AD), the `MachineAccountQuota` is a limit set on how many computer accounts a specific user or group can create in the domain. 14 15 When a user attempts to create a new computer account, AD checks the current number of computer accounts that the user has already created against the defined quota for that user or group. 16 17 However, Active Directory does not store the current count of created machine accounts directly in a user attribute. Instead, you would need to perform a query to count the machine accounts that were created by a specific user. 18 19 ## Machine Account Quota Process 20 21 1. **Quota Definition**: The `MachineAccountQuota` is defined at the domain level and can be set for individual users or groups. By default, it is set to **10** for the "Domain Admins" group and to 0 for standard users, limiting their capability to create computer accounts. 22 23 ```powershell 24 nxc ldap <ip> -u user -p pass -M maq 25 ``` 26 27 2. **Creation Process**: When a user attempts to create a new computer account (for example, by using the "Add Computer" option in Active Directory Users and Computers or via PowerShell), the account creation request is made to the domain controllers (DCs). 28 29 ```powershell 30 impacket@linux> addcomputer.py -computer-name 'ControlledComputer$' -computer-pass 'ComputerPassword' -dc-host DC01 -domain-netbios domain 'domain.local/user1:complexpassword' 31 ``` 32 33 3. **Quota Evaluation**: Before the account is created, Active Directory checks the current count of computer accounts created by that user. This is done by querying the `msDS-CreatorSID` attribute, which holds the SID of the user who created that object. 34 The system compares this count to the `MachineAccountQuota` value set for that user. If the count is less than the quota, the creation proceeds; if it equals or exceeds the quota, the creation is denied, and an error is returned. 35 36 ```powershell 37 # Replace DOMAIN\username with the actual domain and user name 38 $user = "DOMAIN\username" 39 40 # Get the user's SID 41 $userSID = (Get-ADUser -Identity $user).SID 42 43 # Count the number of computer accounts created by this user 44 $computerCount = (Get-ADComputer -Filter { msDS-CreatorSID -eq $userSID }).Count 45 46 # Display the count 47 $computerCount 48 ``` 49 50 4. **Failure Handling**: If the quota is exceeded, the user attempting to create the account will receive an error message indicating that they cannot create a new computer account because they have reached their quota limit. 51 52 ## References 53 54 * [MachineAccountQuota - The Hacker Recipes - 24/10/2024](https://www.thehacker.recipes/ad/movement/builtins/machineaccountquota) 55 * [MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings - Kevin Robertson - March 6, 2019](https://www.netspi.com/blog/technical-blog/network-penetration-testing/machineaccountquota-is-useful-sometimes/) 56 * [Machine Account Quota - NetExec - 13/09/2023](https://www.netexec.wiki/ldap-protocol/machine-account-quota)