---
id: 3727
title: "Set ms-DS-MachineAccountQuota to 0"
source_domain: projectblack.io
source_url: "https://projectblack.io/blog/set-ms-ds-machineaccountquota-to-0/"
published_at: "2026-01-01 06:12"
tags: ["active-directory", "blue-team", "hardening", "relay-attack", "machineaccountquota", "security-baseline"]
phying_url: "https://phying.com/item/3727"
lang: en
---

# Set ms-DS-MachineAccountQuota to 0

## Summary

The default MachineAccountQuota lets low-privileged users add up to 10 computer accounts, a common pivot in relay attacks. The post shows how to set it to 0 and audit past abuse via mS-DS-CreatorSID.

## Intelligence Metadata

- **Sources:** projectblack.io
- **Published:** 2026-01-01 06:12
- **Original:** https://projectblack.io/blog/set-ms-ds-machineaccountquota-to-0/
- **Phying News:** https://phying.com/item/3727