How can I increase the number of PCs a specific user can join to a domain?

Question

All the articles regarding this issue suggest to change the ms-DS-MachineAccountQuota attribute, which affects all the authenticated users.

Is there any way to change this value, or even better remove any limit, for a specific user?

Solution

1. Open the ADSI Edit MMC snap-in and connect to the Domain Naming Context.
2. Right-click on the domainDNS object for the domain you want to change and select Properties.
3. Edit the ms-DS-MachineAccountQuota attribute and enter the new quota value.
4. Click OK twice.

More info here

As you say, this affects ALL authenticated users, but you want specific users.

Try this:

Grant the "Create Computer Objects" and "Delete Computer Objects" Access Control Entries (ACEs) to the User

1. From the Active Directory Users and Computers snap-in, click Advanced Features on the View menu so that the Security tab is exposed when you click Properties.
2. Right-click the Computers container, and then click Properties.
3. On the Security tab, click Advanced.
4. On the Permissions tab, located the user object(s) you want to give the permissions to, and then click View/Edit.
5. Make sure the This object and all child objects option is displayed in the Apply onto box.
6. From the Permissions box, click to select the Allow check box next to the Create Computer Objects and Delete Computer Objects ACEs, and then click OK.

Based on Method #2 from "MSKB251335 Domain Users Cannot Join Workstation or Server to a Domain"

Comments

[nick rulez]

Hi. Thanks for your reply. I had already found that link but it seems to me that the change is applied to all the users, not to a specific one.

[Ƭᴇcʜιᴇ007]

gotcha! My bad. :)

[Ƭᴇcʜιᴇ007]

I think I found it, I'll add it to my answer...

[nick rulez]

Tomorrow I'll try and I'll let you know. For the moment thanks for your kindness and I upvote you on the trust. ;)