Set ms-DS-MachineAccountQuota to 0
projectblack.io | research | #active-directory | #blue-team | #hardening | #relay-attack | #machineaccountquota | #security-baseline
Summary
The default MachineAccountQuota lets low-privileged users add up to 10 computer accounts, a common pivot in relay attacks. The post shows how to set it to 0 and audit past abuse via mS-DS-CreatorSID.
- Published
- Collected
--- id: 3727 title: "Set ms-DS-MachineAccountQuota to 0" source_domain: projectblack.io source_url: "https://projectblack.io/blog/set-ms-ds-machineaccountquota-to-0/" published_at: "2026-01-01 06:12" tags: ["active-directory", "blue-team", "hardening", "relay-attack", "machineaccountquota", "security-baseline"] phying_url: "https://phying.com/item/3727" lang: en --- # Set ms-DS-MachineAccountQuota to 0 ## Summary The default MachineAccountQuota lets low-privileged users add up to 10 computer accounts, a common pivot in relay attacks. The post shows how to set it to 0 and audit past abuse via mS-DS-CreatorSID. ## Intelligence Metadata - **Sources:** projectblack.io - **Published:** 2026-01-01 06:12 - **Original:** https://projectblack.io/blog/set-ms-ds-machineaccountquota-to-0/ - **Phying News:** https://phying.com/item/3727