ADACL-009: Machine Account Quota
- Platform
- Active Directory
- Category
- AD ACL & Delegation
- Severity
- High
- Zero Trust pillar
- Identity (weight 2)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Guerrilla queries the domain root object (defaultNamingContext) and reads the ms-DS-MachineAccountQuota attribute. The expected secure value is 0. Any non-zero value, including the Microsoft default of 10, fails the check. The cmdlet also enumerates the SELF and Authenticated Users SIDs in nTSecurityDescriptor of the Computers container and any custom computer OUs to detect equivalent grants of the Create Computer Objects extended right that bypass the quota gate.
Why it matters
A non-zero MachineAccountQuota gives every authenticated principal in the domain a write primitive. The creator of a machine account becomes its mS-DS-CreatorSID and retains delegated write access to several security-sensitive attributes on that object for its lifetime, including servicePrincipalName, dNSHostName, and msDS-AllowedToActOnBehalfOfOtherIdentity. That single primitive turns generic ACL or coercion findings (Print Spooler, PetitPotam, WebClient, DFS) into reliable domain takeover paths. It is also the staging point for the well-known sAMAccountName spoofing chain (CVE-2021-42278 / CVE-2021-42287, "noPac" / "sAMAccountName impersonation"), where an attacker creates a machine account, renames it to match a Domain Controller, and requests a service ticket as a privileged user. Reducing the quota to 0 closes the easiest path to those attacks without breaking the domain join workflow for legitimate admins.
Attack path
Standard exploitation sequence: 1. Authenticate to the domain as any user (no special rights required). 2. Create a machine account with Impacket addcomputer.py, PowerMad New-MachineAccount, or StandIn. The account is created under CN=Computers and the creator becomes the owner. 3. Use the new machine account in a resource-based constrained delegation attack: set msDS-AllowedToActOnBehalfOfOtherIdentity on a target computer object (any object where the attacker has GenericWrite or the target was created by the attacker) to reference the new machine account, then call S4U2Self / S4U2Proxy with Rubeus or Impacket getST.py to obtain a service ticket as a Domain Admin. 4. Alternative chain: use the new machine account as the relay target for an NTLM coercion (PetitPotam / DFSCoerce / PrinterBug) to obtain a TGT or a delegated ticket for a DC. 5. Alternative chain (sAMAccountName spoofing): create the machine account, blank its servicePrincipalName, rename its sAMAccountName to DC01 (no trailing dollar), request a TGT, then request an S4U2Self ticket. KDC issues a PAC for DC01$ and the attacker resolves Domain Admin tickets via U2U. Patched by CVE-2021-42278 / CVE-2021-42287, but historical and unpatched environments are still affected. Tooling: Impacket (addcomputer.py, ntlmrelayx.py, getST.py), PowerMad, StandIn, Rubeus, Certipy (when chained to ADCS ESC8/ESC1), BloodHound (path discovery via AddSelf and AddAllowedToAct edges).
How Guerrilla assesses it
Guerrilla binds to the domain root via LDAP and reads ms-DS-MachineAccountQuota directly from the defaultNamingContext object. Any value other than 0 raises the finding. The cmdlet additionally: - Enumerates objectClass=computer where mS-DS-CreatorSID is set and the creator is not a member of a Tier 0 admin group, to surface accounts that were pre-staged by ordinary users. - Reads the nTSecurityDescriptor on CN=Computers,<domain DN> and on every OU that contains computer objects, looking for ACEs that grant the Create Child for computer objects right (objectType GUID bf967a86-0de6-11d0-a285-00aa003049e2) to SELF, Authenticated Users, Domain Users, or any non-Tier 0 principal. - Flags machine accounts whose msDS-AllowedToActOnBehalfOfOtherIdentity is populated, since this is the canonical RBCD payload and frequently a leftover from prior abuse.
Recommended value
ms-DS-MachineAccountQuota set to 0
Remediation
Set ms-DS-MachineAccountQuota to 0 on the domain root using Set-ADDomain -Identity (Get-ADDomain) -Replace @{'ms-DS-MachineAccountQuota'=0}. Delegate computer account creation to specific admin groups or use a prestaging workflow. Review existing computer accounts created by non-admin users.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6, AC-6
- ANSSI
- vuln_machineaccountquota
- MITRE ATT&CK
- T1098, T1136.002