• You might have noticed that users that are not members of the Domain Admin group are adding computers to the AD domain
• TIP: You can look for event ID 4741 in the Domain Controller “Security” event log to see who added a computer to the domain

• This is expected behavior. Members of the Domain Users group can add up to 10 computers to the AD domain

1. Open Active Directory Users and Computers (dsa.msc)
2. On the menu click on “View*” then tick the option “Advanced Features“
3. Right click on your domain name on the right column, then “Properties“
4. Click on the “Attribute Editor” tab
5. Find the “ms-DS-MachineAccountQuota“ attribute and click “Edit“
6. Set the value from 10 to 0, then save

1. Open an elevated PowerShell
2. Run the command

   Set-ADDomain (Get-ADDomain).distinguishedname -Replace @{"ms-ds-MachineAccountQuota"="0"}

Get-ADObject -Identity ((Get-ADDomain).distinguishedname) -Properties ms-DS-MachineAccountQuota

1. Open Group Policy Management Console (gpmc.msc)
2. Locate the “Domain Controllers” OU and expand it
3. Right click on “Default Domain Controllers Policy” then “Edit”
4. Expand:
• Computer Configuration
• Policies
• Windows Settings
• Security Settings
• Local Policies
• User Rights Assignment


5. Find the policy named “Add workstations to domain”
6. Edit the policy by removing the “Authenticated Users” group and adding the security group delegated to adding workstations to the domain
7. Click “Apply” and “Ok”, then close the Group Policy Management Console