Fix 0XC00002E7: Machine Account Quota Exceeded

Trying to join a domain but hitting 0XC00002E7. Means your domain admin account has used up its machine account quota. Fix it with a privileged account or raise the limit.

The 30-Second Fix: Use a Domain Admin Account

Most of the time, this error shows up because you're trying to join the domain with an account that isn't a domain admin. That account has a limit on how many computers it can add – usually 10. Once you hit that, you get 0XC00002E7.

Real scenario: Had a client last month whose IT guy was using his own user account to join 12 laptops. The 11th worked, the 12th hit the quota. He called me panicking. Told him to log in with the domain admin account – worked in under a minute.

What to do:

Get credentials for an account that's in the Domain Admins group (or Enterprise Admins).
On the computer you're joining, right-click This PC > Properties > Rename this PC (Advanced).
Click Change, select Domain, enter your domain name, then when prompted use the domain admin username and password.
Reboot. Done.

If you can't get domain admin rights, move to the next step.

The 5-Minute Fix: Raise the Machine Account Quota

This is the proper fix if the problem keeps happening because your regular admin account needs to join more machines. You'll need a domain admin to do this once.

How to raise the quota using ADSI Edit:

On a domain controller, open ADSI Edit (if not installed, install it via Server Manager > Tools > ADSI Edit).
Right-click ADSI Edit > Connect to. Leave defaults, click OK.
Navigate to: Default Naming Context > DC=yourdomain,DC=com (your domain).
Right-click the domain object > Properties.
Find the attribute: ms-DS-MachineAccountQuota. Double-click it.
Change the value from the default 10 to something higher – 50 or 100 if you're constantly joining machines. I usually set it to 100 for clients with frequent hardware turnover.
Click OK, close ADSI Edit. The change applies immediately – no reboot needed.

Important: This raises the limit for EVERY non-admin user. If you're paranoid about security, keep it low and use the first fix instead. But for most small businesses, 100 is fine.

If you still get the error after this, you've got a deeper problem. Move to the advanced fix.

The 15-Minute Fix: Check for Orphaned Machine Accounts

Sometimes the quota isn't the real problem – your domain has a bunch of dead computer accounts that are still counted against the quota. Or the account you're using doesn't have the right permissions.

Step 1: Clean out old computer accounts

On a domain controller, open Active Directory Users and Computers (ADUC).
Go to the Computers container (or the OU where machines are joined).
Look for computers that are offline, old, or don't exist anymore – they'll have a red X or show old OS versions.
Right-click each one and delete it. That frees up quota space.

Step 2: Verify the user's permissions

If you're still stuck, the account you're using might not have the Create Computer Objects permission on the target OU. Here's the fix:

In ADUC, right-click the OU where computers go > Properties > Security.
Select your user (or the group they're in).
Check the box for Create Computer Objects under Allow.
Click OK. Now try joining again.

Step 3: Use PowerShell to check quota

Run this on a domain controller to see the current quota setting:

Get-ADDomain | Select-Object ms-DS-MachineAccountQuota

If it shows 10 and you changed it in ADSI Edit, something didn't stick. Recheck the attribute name – I've seen people typo it.

Real scenario: I once had a client whose quota was set to 10, but the company had 200 computers. Every week someone hit the quota. I raised it to 500 and added a scheduled cleanup script to delete stale accounts. Never heard from them again.

When Nothing Works

Rare, but possible: replication issues on the domain controller. Check that all DCs are synced with repadmin /replsum. If you see errors, fix the replication first, then retry the join.

Also, double-check there's no typo in the domain name you're joining. I've seen people write contoso.com instead of the real domain – that gives a different error usually, but worth a look.

Bottom line: 0XC00002E7 is almost always a quota or permission problem. Start with the domain admin account, then raise the quota, then clean up old accounts. You'll be joined in 10 minutes max.