Machine Account Quota (MAQ) is an Active Directory setting that limits how many computer accounts a non-administrator can create by default. In many domains, this means a regular user can join or create a small number of machine objects without elevated rights. Those objects are not just inventory entries: they are security principals with their own passwords, trust relationships, and in some cases useful privileges.
MAQ matters because attackers often look for low-friction ways to gain a foothold in identity infrastructure. If MAQ is too permissive, a compromised user account may create machine objects that help with lateral movement, delegation abuse, or other Active Directory abuse chains. Defenders usually reduce MAQ to the lowest workable value, monitor unusual computer-account creation, and review who can add devices to the domain. Tight MAQ settings do not stop every attack, but they remove an easy path from user-level access to stronger directory abuse.