Re: Default domain permissions on who can join a workstation to the domain

The Active Directory property your concerned with is 
"ms-DS-MachineAccountQuota".  The easy way to modify this is to use the 2000 
Support Tools included ADSIedit.msc; you can browse to your 
"DC=Your-Domain-Name,DC=com", right click properties, inspect (default is 
'10'), and then set the value.


Reference:
"Domain Users Cannot Join Workstations or Server to a Domain"
http://support.microsoft.com/kb/251335/EN-US/


You may want to check out O'Reilly's "Active Directory Cookbook"
http://www.rallenhome.com/books/adcookbook/src/08.09-change_computer_quota.vbs.txt

There's a script for limiting # of computers each user may join using perl or 
vbs if your going to develop some kind of 'hardening' procedure.


Liam Randall
Network Engineer

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an 
Anti-Virus product which automatically notifies the perceived sender of a 
message it believes is infected may well cause more harm than good. Someone who 
did not actually send you a virus may receive the notification and scramble 
their support staff to find an infection which never existed in the first 
place. Suggest such notifications be disabled by whomever is responsible for 
your AV, or at least that the idea is considered.
--