In the Dream case, the domain had lockoutThreshold=0, so the attacker could spray passwords at every account without limit, and the default MachineAccountQuota let any authenticated account try to add machine accounts.

1. Run Get-ADDefaultDomainPasswordPolicy and set a lockout threshold that fits your helpdesk load (with fine-grained policies for service accounts if needed).
2. Run Get-ADObject (Get-ADDomain).DistinguishedName -Properties ms-DS-MachineAccountQuota and set it to 0, delegating computer joins to a specific group instead.
3. Treat LDAP service accounts used by firewalls and VPNs as high value: least privilege, long random passwords, and alerts when they log on from anything but the appliance.