| Previous | Next |
| ERROR_DS_UNICODEPWD_NOT_IN_QUOTES | ERROR_DS_MUST_BE_RUN_ON_DST_DC |
ERROR_DS_MACHINE_ACCOUNT_QUOTA_EXCEEDED
The domain’s delegated computer-account creation quota is exhausted
The domain attribute ms-DS-MachineAccountQuota controls how many computer accounts an ordinary user may create. This is separate from explicit delegated rights on an organizational unit. Once the caller reaches the quota, another join or computer-object creation is rejected even when the proposed name is unused.
Read the quota on the domain object and identify computer accounts attributed to the caller. Decide whether the correct remedy is cleanup, explicit OU delegation for a managed provisioning identity, or a deliberate quota change. Raising the domain-wide quota grants broader creation capability to users and is rarely the best least-privilege fix. Also distinguish quota failure from permissions, duplicate-name, DNS, and secure-channel errors that occur later in domain join.
What to inspect
- Read ms-DS-MachineAccountQuota on the domain object.
- Inventory computer accounts created by the requesting identity.
- Prefer explicit OU delegation over a broad quota increase.
References
- Microsoft: ms-DS-MachineAccountQuota attribute
- MS-ADTS: domain-joined computer accounts
- Microsoft: least-privilege AD administration
Looking for a different code? Search another status or error code.