AD domain allows unprivileged users to add computer accounts

This threat is rated high severity because an attacker can use the ms-DS-MachineAccountQuota attribute to create legitimate-looking computer accounts, which can then be used to perform authentication requests and gain unauthorized access to the domain. Specifically, this allows attackers to bypass security controls and move laterally within the network.

Attackers can exploit the ms-DS-MachineAccountQuota attribute by creating legitimate-looking computer accounts that can perform authentication requests, allowing them to gain unauthorized access to the domain and use it as a foothold for further attacks. This enables attackers to move laterally within the network, increasing their chances of successful exploitation.

Cayosoft Guardian continuously monitors the ms-DS-MachineAccountQuota attribute across the Active Directory environment and flags it as a security issue when set to a value greater than 0, alerting administrators to potential threats. This provides visibility into potential attack paths and enables swift response.

Cayosoft Guardian helps reduce the risk by alerting administrators to set the ms-DS-MachineAccountQuota attribute to 0, blocking non-admin users from adding new devices and limiting an attacker's ability to create legitimate-looking computer accounts. This supports investigation and response efforts by providing a clear audit trail of changes made to the attribute.