AD : Increase the “ms-DS-MachineAccountQuota” Limit

By default, an Active Directory domain allows any authenticated domain user to join workstations in the domain. The limit is 10 times. You may need to increase or decrease this limit for enterprise needs.

Go to the DC server and open the ADSI Edit MMC. Right-click on your domain and select “Properties

Now, find the attribute called ms-DS-MachineAccountQuota. You can set the value to 0 which means no limit.

Please note that this limit is not applied for any user account which is a member of domain admins or enterprise admins group.

You can use PowerShell to get the value:

PS > Get-ADDomain | Get-ADObject -Properties 'ms-DS-MachineAccountQuota'  

Thanks for reading! You can follow me on Twitter @PrigentNico

About Nicolas 254 Articles
I work as a System Engineer, based in Switzerland with a primary focus on Microsoft technologies. I have 8 years experience in administering Windows Servers. . I am a Microsoft MVP for Cloud & Datacenter Management. I also received the PowerShell Hero 2016 award by PowerShell.0rg. And finally, I am "MCSE: Cloud Platform and Infrastructure", "MCSA: Windows Servers", "Administering & Deploying SCCM", and CheckPoint CCSA certified.