Machine Account Quota is an Active Directory domain setting that limits how many computer accounts a normal user can create. In many environments, the default value is 10, which means a non-administrator can join or create a limited number of machines in the domain without special rights.
This setting matters because each computer account is an identity with Kerberos trust and directory attributes that can be abused if other controls are weak. Attackers may create a machine account as a foothold, then use it in delegation, authentication, or privilege-escalation chains when permissions are misconfigured. Defenders often reduce the quota to 0, delegate machine joins only to specific groups, and monitor for unusual computer-account creation, especially accounts that do not match normal naming or provisioning patterns. In practice, Machine Account Quota is a small default that can become a useful pivot point in identity-based attacks.