TIP: Stop users from adding their own computers to your Windows domain.

By default, when a Windows domain is created, users are granted the right to add up to ten workstations to the domain (in to the Computers container) without requiring any other privileges. Obviously this is a security risk so you should probably do something about it….

This ten computer policy is governed by the ms-DS-MachineAccountQuota attribute on the domain and you can adjust this down to zero by following the steps below:

1. Open ADSI Edit from the Administrative Tools folder.
2. Right-click ADSI Edit and choose Connect To.
3. In the Connection Point section, choose Select A Well Known Naming Context and, from the drop-down list, choose Default Naming Context.
4. Click OK.
5. Expand Default Naming Context.
6. Right-click the dc=[domain],dc=[com] domain folder, for example, and choose Properties.
7. Select ms-DS-MachineAccountQuota and click Edit.
8. Type 0.
9. Click OK.

-Lewis

UPDATE: Remember that your cluster’s computer accounts will still need to be able to create Computer objects so grant them privileges to do so or you will block them from creating computer accounts.