---
id: 8103
title: "MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/network-pentesting/machineaccountquota-is-useful-sometimes/"
published_at: "2019-03-06T00:00:00Z"
tags: ["active-directory", "privilege-escalation", "kerberos", "defense", "machineaccountquota", "delegation", "powermad"]
phying_url: "https://phying.com/item/8103"
lang: en
---

# MachineAccountQuota is USEFUL Sometimes: Exploiting One of Active Directory's Oddest Settings

## Summary

Kevin Robertson details ten attacker rules for MachineAccountQuota, which lets unprivileged users add up to 10 machine accounts, plus Powermad techniques and the defense of setting MAQ to 0.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2019-03-06T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/network-pentesting/machineaccountquota-is-useful-sometimes/
- **Phying News:** https://phying.com/item/8103