Domain users can add computer to the Active Directory domain

What many administrators do not know:
Authenticated domain users can add up to 10 new computer objects to the domain by default.

In some environments this may not be wanted though for security reasons.

How to prevent that users can add computer objects?

It is quite simple to adapt the default value according to your wishes in the Active Directory attribute ‘ms-DS-MachineAccountQuota’ on the domain via ADSIEDIT.MSC or LDP.EXE.

And so the domain becomes somewhat more secure. 🙂