Recipe 8.9 Changing the Maximum Number of Computers a User Can Join to the Domain

8.9.1 Problem

You want to grant users the ability to join more or fewer than 10 computers to a domain. This limit is called the machine account quota.

8.9.2 Solution

8.9.2.1 Using a graphical user interface

1. Open ADSI Edit.

2. Right-click on the domainDNS object for the domain you want to change and select Properties.

3. Edit the ms-DS-MachineAccountQuota attribute and enter the new quota value.

4. Click OK twice.

8.9.2.2 Using a command-line interface

In the following LDIF code replace <DomainDN> with the distinguished name of the domain you want to change and replace <Quota> with the new machine account quota:

dn: <DomainDN> changetype: modify replace: ms-DS-MachineAccountQuota ms-DS-MachineAccountQuota: <Quota> -

If the LDIF file was named change_computer_quota.ldf, you would then run the following command:

> ldifde -v -i -f change_computer_quota.ldf

8.9.2.3 Using VBScript

' This code sets the machine account quota for a domain. ' ------ SCRIPT CONFIGURATION ------ intQuota  = <Quota> strDomain = "<DomainDNSName>"  ' e.g. emea.rallencorp.com ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE") set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext")) objDomain.Put "ms-DS-MachineAccountQuota", intQuota objDomain.SetInfo WScript.Echo "Updated user quota to " & intQuota

8.9.3 Discussion

In a default Active Directory installation, members of the Authenticated Users group can add and join up to 10 computer accounts in the default Computers container. The number of computer accounts that can be created is defined in the ms-DS-MachineAccountQuota attribute on the domainDNS object for a domain. The default setting is artificially set to 10, but you can easily change that to whatever number you want, including 0, via the methods described in the Solution section. If you set it to 0, users have to be granted explicit permissions in Active Directory to join computers, such as those described in Recipe 8.3.

Another method for granting users the right to add computer objects, although not recommended, is via group policy. If you grant the "Add workstation to domain" right via Computer Configuration Windows Settings Security Settings Local Policies User Rights Assignment, then users will be able to create computer accounts even if they do not have create child permissions on the default Computers container. This is a holdover from Windows NT to maintain backwards compatibility, and should not be used unless absolutely necessary.

8.9.4 See Also

Recipe 8.3 for permissions needed to join computers to a domain, MS KB 251335 (Domain Users Cannot Join Workstation or Server to a Domain), and MS KB 314462 ("You Have Exceeded the Maximum Number of Computer Accounts" Error Message When You Try to Join a Windows XP Computer to a Windows 2000 Domain)