ms-DS-MachineAccountQuota set to 9999 was not recognized

Products PingCastle Discussions & Questions
1

In the Current Version 3.5.1.33 (dont know if earlier versions are working correctly)

It is not recognized, when the attribute ms-DS-MachineAccountQuota was 9999

The check should trigger a rule when the value is > Zero

Thanks

Dominik

2

Hi Dominik,
Is this for Threat Prevention or Threat Manager? I’ll move it to the appropriate category so the team sees it.

3

Hi Derek,

sorry it is for pingcastle. probably chose the wrong program

4

HI @dominik.kuntz
I don’t think anything would have changed here recently.

I believe you may be experiencing this because you have a GPO assigning a lesser scoped group or principal to the “Add workstations to domain” permission (SeMachineAccountPrivilege) to and not Authenticated Users, Everyone, Users or Anonymous principals which we would trigger on.

This means that your scoped group could add 9999 machines.

Could you check this out?

Cheers,
Joe

5

Hi Joe,

thank you. That’s the reason

Best,

Dominik