[ Team LiB ] |
![]() ![]() |
Recipe 8.9 Changing the Maximum Number of Computers a User Can Join to the Domain8.9.1 ProblemYou want to grant users the ability to join more or fewer than 10 computers to a domain. This limit is called the machine account quota. 8.9.2 Solution8.9.2.1 Using a graphical user interface
8.9.2.2 Using a command-line interfaceIn the following LDIF code replace <DomainDN> with the distinguished name of the domain you want to change and replace <Quota> with the new machine account quota: dn: <DomainDN> changetype: modify replace: ms-DS-MachineAccountQuota ms-DS-MachineAccountQuota: <Quota> - If the LDIF file was named change_computer_quota.ldf, you would then run the following command: > ldifde -v -i -f change_computer_quota.ldf 8.9.2.3 Using VBScript' This code sets the machine account quota for a domain. ' ------ SCRIPT CONFIGURATION ------ intQuota = <Quota> strDomain = "<DomainDNSName>" ' e.g. emea.rallencorp.com ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://" & strDomain & "/RootDSE") set objDomain = GetObject("LDAP://" & objRootDSE.Get("defaultNamingContext")) objDomain.Put "ms-DS-MachineAccountQuota", intQuota objDomain.SetInfo WScript.Echo "Updated user quota to " & intQuota 8.9.3 DiscussionIn a default Active Directory installation, members of the Authenticated Users group can add and join up to 10 computer accounts in the default Computers container. The number of computer accounts that can be created is defined in the ms-DS-MachineAccountQuota attribute on the domainDNS object for a domain. The default setting is artificially set to 10, but you can easily change that to whatever number you want, including 0, via the methods described in the Solution section. If you set it to 0, users have to be granted explicit permissions in Active Directory to join computers, such as those described in Recipe 8.3. Another method for granting users the right to add
computer objects, although not recommended, is via
group policy. If you grant the "Add workstation to
domain" right via Computer Configuration 8.9.4 See AlsoRecipe 8.3 for permissions needed to join computers to a domain, MS KB 251335 (Domain Users Cannot Join Workstation or Server to a Domain), and MS KB 314462 ("You Have Exceeded the Maximum Number of Computer Accounts" Error Message When You Try to Join a Windows XP Computer to a Windows 2000 Domain) |
[ Team LiB ] |
![]() ![]() |