---
title: Two Active Directory settings the PHP2Shell firewall intruders leaned on: set an account lockout threshold and drop MachineAccountQuota to 0 | ctxsec
url: https://ctxsec.com/items/tip-ad-lockout-and-machine-account-quota-after-edge-compromise
description: ""
status: "guidance"
published: 2026-10-28
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-ad-lockout-and-machine-account-quota-after-edge-compromise.md)

guidance

2026-10-28

### Two Active Directory settings the PHP2Shell firewall intruders leaned on: set an account lockout threshold and drop MachineAccountQuota to 0

In the [Dream case](/items/dream-php2shell-fragnesia-chain-roots-24-firewalls-us-gov), the domain had `lockoutThreshold=0`, so the attacker could spray passwords at every account without limit, and the default `MachineAccountQuota` let any authenticated account try to add machine accounts.

1. Run `Get-ADDefaultDomainPasswordPolicy` and set a lockout threshold that fits your helpdesk load (with fine-grained policies for service accounts if needed).
2. Run `Get-ADObject (Get-ADDomain).DistinguishedName -Properties ms-DS-MachineAccountQuota` and set it to 0, delegating computer joins to a specific group instead.
3. Treat LDAP service accounts used by firewalls and VPNs as high value: least privilege, long random passwords, and alerts when they log on from anything but the appliance.

Sources: [Dream Research: Chained PHP2Shell Exploit Roots 25 Servers, including US Government Servers (Oct 26)](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) · [Microsoft Learn: Account lockout threshold](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/security-policy-settings/account-lockout-threshold)