Skip to content
Set ms-DS-MachineAccountQuota to 0
projectblack.io | research | #active-directory | #blue-team | #hardening | #relay-attack | #machineaccountquota | #security-baseline
Summary
The default MachineAccountQuota lets low-privileged users add up to 10 computer accounts, a common pivot in relay attacks. The post shows how to set it to 0 and audit past abuse via mS-DS-CreatorSID.
- Published
- Collected