Implementing Windows Server 2003 AD Object Quotas

Windows Server 2003 Active Directory (AD) introduces a new feature that's commonly referred to as AD object quotas. What's this feature, and what's its security value?

Windows 2003 AD object quotas determine the number of objects that a particular security principal can own in an AD naming context (NC) or directory partition. These quotas can help prevent Denial of Service (DoS) attacks on AD domain controllers (DCs). Without them, an authorized user can bring down an AD server by creating AD objects until a DC runs out of storage space.

You can specify and administer AD object quotas for each AD NC and directory partition, but you can't define them for the schema NC. You can define a default quota for every AD NC and directory partition. However, if you don't explicitly set a default quota on an NC or partition, the default quota for that NC or partition will be unlimited.

The AD object quota logic counts any tombstone objects that a security principal owns as part of that principal's AD object quota consumption. Tombstone objects are temporary AD entries that point to deleted AD objects. AD maintains these objects to keep deleted object data consistent across different AD DCs. For each NC and directory partition, you can specify a tombstone quota factor that determines the weight given to a tombstone object in quota accounting. For example, if the tombstone quota factor for a given NC or directory partition is set to 25, then a tombstone object in the partition is counted as 0.25 of a regular AD object. Because the default tombstone quota factor for each partition is set to 100, regular AD objects and tombstone objects are weighted equally. . . .