Domain join: How are the computer account and Netlogon secure channel created?

1. Core mechanism

The client participating in Domain, the computer object in the directory (objectClass computer), the password of the machine account (stored on the client as LSA secret), and secure channel established between the client Netlogon service and a DC. This lesson covers the creation/reuse of computer account and the identity basis of secure channel; He leaves finding DC with the DC Locator to 04.01, Kerberos leaves ticket mechanics to chapter 06, and cryptographic use of the machine password to advanced Netlogon lessons.

Interfaces and specifications

• computer object (objectClass: computer): Directory object representing the machine participating in domain; sAMAccountName ends with '$ (e.g. WS-034$).
• ms-DS-MachineAccountQuota: domain-level default allowance for the quota-managed “Add workstations to domain” user-right route; the default value is 10.
• Machine account password: ID material set at join, kept as secret on the client as LSA, and renewed by default every ~30 days.
• Netlogon secure channel: secure communication channel between a client Netlogon service and a DC based on machine account identity.
• Directory userAccountControl / WORKSTATION_TRUST_ACCOUNT (0x1000): the AD attribute bit identifying a computer account. Event 4741 NewUacValue is a separate SAM User Account code field; the example value 0x80 denotes a workstation-trust account.
• primaryGroupId 515: The default primary group of machine accounts is Domain Computers.
• SeMachineAccountPrivilege: the “Add workstations to domain” user right; this is the quota-managed authorization route for creating a new computer account, not a second gate independent of the quota.
• Create Computer Objects (ACTRL_DS_CREATE_CHILD): an explicit ACL permission on the target OU/container; an alternative to the quota-managed user-right route for creating a new account. Reusing an existing account has separate permission requirements.

Domain join is an 'object + password' operation

Joining a machine to a domain creates a computer object representing it in the directory or reuses an existing object. This object is a security principal: it has its own SID, sAMAccountName (WS-034$) and password. Like a user, the machine becomes a security principal in the domain.

The machine password specified during join is associated with the account in the directory; On the client side, it is stored as LSA secret, not as clear text. This password is not a password written by a human; The operating system generates and manages it.

Let's follow one object throughout this lesson: WS-034$ is created (4741), primaryGroupId 515 (Domain Computers) is assigned, and its UAC contains WORKSTATION_TRUST_ACCOUNT. Event 4741's NewUacValue uses a separate SAM code mapping: the example value 0x80 is not the same numeric representation as the 0x1000 bit in the directory userAccountControl attribute.

New computer accounts have two alternative authorization paths

A common misconception is that only administrators can add computers to a domain. By default, ms-DS-MachineAccountQuota = 10 allows an authenticated user to create up to 10 new computer accounts through the “Add workstations to domain” (`SeMachineAccountPrivilege`) route. The quota manages the numerical allowance on this user-right route; it is not a second control independent of the privilege.

The alternative path for creating a new account is explicit Create Computer Objects (`ACTRL_DS_CREATE_CHILD`) permission on the target OU/container. This ACL path and the quota-managed user-right path are alternatives; both are not required together. Reusing an existing computer account during join has separate owner/ACL requirements.

During review, first distinguish creating a new object from reusing a precreated one. For a new object, distinguish the quota-managed user-right path from the target OU/container ACL path. Setting the quota to 0 closes the default allowance, but does not remove explicit Create Computer Objects ACLs.

The secure channel is based on the machine identity, and its password is renewed

Once the join is complete, the client’s Netlogon service establishes a secure channel with a DC based on the machine account ID. This channel supports pass-through authentication and secure transactions between the machine and the domain; The machine whose basis is specified in join is password is.

The machine password is not fixed: by default it is changed by member domain approximately every 30 days, with the policy 'Domain member: Maximum machine account password age'. The party that initiates the change is the member machine; DC accepts this. This cycle limits the lifespan of a stolen old machine password.

A mismatch between the value of the password in the client and the directory (e.g. machine returning from an old snapshot, device going offline and missing synchronization) corrupts secure channel and the machine produces errors of the 'Failed to establish a secure session with domain' class.

State and data flow

1. Join request: Creates a computer object in the directory or reuses an existing object in the context of a user.
2. Authorization check: for a new object, evaluate either the quota-managed Add workstations to domain right or explicit Create Computer Objects permission on the target OU/container; reusing an existing object is a separate flow.
3. A newly created object receives its SID, sAMAccountName, primaryGroupId and account flags. With applicable auditing, creation can produce 4741. Reusing an existing object does not create a new SID or prove a new-account event.
4. The machine password is set; It is stored as LSA secret on the client and associated with the account in the directory.
5. The client’s Netlogon service establishes a secure channel with a DC using the machine identity.
6. The member OS/Netlogon initiates password change. The client LSA secret and DC account data are updated; subsequent secure-channel checks depend on compatibility. A mismatch outside current/previous history tolerance can cause failure.

2. Exploitation

Broken trust assumption

The assumption that is broken is that creating computer account is a purely administrative operation and that the machine account carries no attack surface because it is 'just a computer'. In fact, the machine account is a security principal that even low-authority users can create and become an entry into subsequent abuse chains.

Technical prerequisites

• A valid, authenticated domain user (not necessarily an administrator).
• With the default ms-DS-MachineAccountQuota = 10, an authenticated user can create a new computer account through the quota-managed user-right route; explicit Create Computer Objects permission on the target OU/container is an alternative route.
• The attributes of the machine account created for subsequent impact (e.g. SPN, delegation settings) can be set as required by the target abuse technique and other prerequisites of that technique are met.

Exploitation mechanism

By default, the quota gives an authenticated user the ability to create a computer account through the quota-managed Add workstations to domain right; an explicit Create Computer Objects ACL on the target OU/container is an alternative way to create a new account. Neither path alone is a domain compromise; an attacker-controlled machine principal can only be an entry point to later abuse chains. The quota defines the default allowance, while ACLs/delegation and target-service configuration determine whether later technique prerequisites are met. On the machine-password side, the risk is that long-lived or disabled machine-password changes extend the period in which a stolen password can be used.

Creating a low-privilege principal is only the beginning

Creating an attacker-controlled machine account is not the authorization itself, but a prerequisite for the next steps. The impact depends on what rights/attributes can be granted to this principal and the verification of the target systems.

That's why the 'quota 10' default is not a vulnerability, but a risk multiplier: if it is restricted, it closes the entry steps of many abuse chains.

The machine password defines an impact window

The OS renews the machine password under the default policy of roughly 30 days. This limits secret age, which is different from the brute-force resistance of a high-entropy machine password. Windows can tolerate some synchronization delays using current/previous password history. A single rotation therefore does not prove that a stolen older secret immediately fails everywhere or that compromise has been remediated.

The attack focus of this lesson is not on the details of the cryptographic use of the password; It's just 'how the identity is produced and how long it is trusted'. Advanced Netlogon security topics are covered in separate lessons.

3. Defense & Detection

Telemetry scope

• Computer account lifecycle events are generated only on domain controllers and require the Success setting of the Audit Computer Account Management subcategory.
• 4741 (A computer account was created) is generated when a new computer object is created; The Subject field shows who performed the operation, and the New Computer Account field shows which object was created.
• At 4741, read SubjectUserSid and SamAccountName together: 'who' created it and 'what' was created are separate questions. An unexpected Subject is a review signal; the event alone does not prove whether the quota-managed user-right route or target OU/container ACL route was used.
• The Secure channel fault is a different piece of evidence: events such as 5719 from NETLOGON in the client System log ('failed to establish secure session') indicate a machine password/DC access problem. Do not consider 4741 and 5719 to be the same bucket.

Events and relevant fields

• 4741 / SubjectUserSid, SubjectUserName, SubjectDomainName, SubjectLogonId: actor and session correlation key that creates the computer object.
• 4741 / TargetUserName, TargetSid, SamAccountName: the name (ending in '$) and SID of the created computer account.
• 4741 / PrimaryGroupId: typical 515 for machine accounts (Domain Computers).
• 4741 / OldUacValue, NewUacValue, UserAccountControl: NewUacValue uses the event’s SAM User Account codes (the example value 0x80 denotes workstation trust); the WORKSTATION_TRUST_ACCOUNT bit in the directory userAccountControl attribute is 0x1000. Do not treat them as the same numeric bitmask.
• 4741 / DnsHostName, ServicePrincipalNames: the name of the machine and SPNs; Inspection point for anomalous or attacker-set SPNs.
• 4741 Version is 0 and the event is generated only on DC; these fields should be interpreted with the document schema, not with cross-version assumptions.

'Who created it' and 'what formed it' are separate questions.

In 4741, Subject (the creator) and New Computer Account (the created object) are separate identity blocks. An unexpected ordinary-user Subject is a review signal; however, event 4741 alone does not reveal whether the quota-managed user-right route or the Create Computer Objects ACL on the target OU/container was used.

So the alarm threshold should be 'Subject other than expected provisioning IDs', not the raw number 4741. This distinction requires inventory (delegated accounts, OSD services).

Confusing error secure channel with create event

4741 tells you that an object was born in the directory. Whether the machine is able to establish a secure session with a DC is visible in client-side NETLOGON events (e.g. 5719); This is usually related to password mismatch, DC access, or time/DNS issues.

Two sets of evidence point to different root causes: one 'authority/establishment', the other 'identity/trust continuum'. Clarify which question you are answering in the review.

Detection logic · Sigma

title: Sıradan kullanıcı tarafından computer account olusturma
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4741
  filter_expected_provisioning:
    SubjectUserSid:
      - 'S-1-5-21-000-000-000-519'   # placeholder: envanterle degistir (delege provisioning/OSD hesaplari)
  condition: selection and not filter_expected_provisioning
fields:
  - SubjectUserSid
  - SubjectUserName
  - TargetUserName
  - SamAccountName
  - NewUacValue
  - ServicePrincipalNames
falsepositives:
  - Yetkili OSD/provisioning sistemleri ve delege edilmis help desk hesaplari
  - Otomatik cihaz kayit is akislari
level: medium

Query assumptions

• 4741 is generated only on DCs and when Audit Computer Account Management / Success is on; collection requires this.
• Populate the filter_expected_provisioning list with the delegated accounts that are actually expected in the environment; an empty placeholder makes the rule meaningless.
• Verify the SubjectUserSid field name and value against the collector's normalization.
• The rule was not run against a real SIEM or data set.

False positives

• Authorized operating system deployment (OSD) and automatic machine provisioning operations.
• Routine machine registration of delegated help desk accounts.
• Expected increase of 4741 during mass redistribution/renewal campaigns.

Hardening

• Inventory join/provisioning flows first. Assess whether quota-managed allowance is needed; independently review target OU/container Create Computer Objects ACLs and delegate only to required provisioning identities. If the quota route is unnecessary, assess ms-DS-MachineAccountQuota=0 through a pilot with a rollback plan.
• Keep 'Domain member: Maximum machine account password age' reasonable (default ~30 days); disabling password change unnecessarily — this prolongs the life of stolen machine secrets.
• Watch for new computer accounts (especially with unexpected SubjectUserSid) and abnormal SPN/delegation settings; Compare object attributes after join with expected baseline.

Read the examples

<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4741</EventID>
    <Version>0</Version>
    <Channel>Security</Channel>
    <Computer>DC01.outreason.example</Computer>
  </System>
  <EventData>
    <Data Name="TargetUserName">WS-034$</Data>
    <Data Name="TargetDomainName">OUTREASON</Data>
    <Data Name="TargetSid">S-1-5-21-1533101619-2072831041-1560920683-6412</Data>
    <Data Name="SubjectUserSid">S-1-5-21-1533101619-2072831041-1560920683-1442</Data>
    <Data Name="SubjectUserName">seyma</Data>
    <Data Name="SubjectDomainName">OUTREASON</Data>
    <Data Name="SubjectLogonId">0x5f3ac1</Data>
    <Data Name="SamAccountName">WS-034$</Data>
    <Data Name="PrimaryGroupId">515</Data>
    <Data Name="OldUacValue">0x0</Data>
    <Data Name="NewUacValue">0x80</Data>
    <Data Name="UserAccountControl">%%2087</Data>
    <Data Name="DnsHostName">ws-034.outreason.example</Data>
    <Data Name="ServicePrincipalNames">HOST/ws-034.outreason.example HOST/WS-034 RestrictedKrbHost/ws-034.outreason.example RestrictedKrbHost/WS-034</Data>
  </EventData>
</Event>

Two reality checks

Assumption: Only administrators can add computer to domain.

In fact: By default, ms-DS-MachineAccountQuota = 10 provides an authenticated user with an allowance of up to 10 new computer accounts through the quota-managed “Add workstations to domain” route. Explicit Create Computer Objects permission on the target OU/container is an alternative; therefore, quota 0 alone does not mean only administrators can create accounts.

Assumption: After joining Domain, the machine password is fixed and managed manually, like the user password.

In fact: The OS manages the machine password and the member initiates changes under the default policy of roughly 30 days. The client LSA secret and DC account data must remain compatible; current/previous history tolerates some delays. This maintenance cycle does not prove completion of credential-compromise remediation.

Sources

• Microsoft · Domain member: Maximum machine account password age
  Each device has an account and password; domain members submit a password change every 30 days by default; brute-force implications
• Microsoft · 4741(S) A computer account was created
  Event XML (Version 0); generated only on DCs; Subcategory Audit Computer Account Management; SubjectUserSid, SamAccountName, PrimaryGroupId 515, NewUacValue, ServicePrincipalNames
• Microsoft · Default workstation numbers a user can join to the domain (ms-DS-MachineAccountQuota)
  ms-DS-MachineAccountQuota default 10; authenticated users; delegated permissions exception
• Microsoft · Active Directory accounts
  Computer accounts as security principals; account/SID model
• Microsoft · Active Directory domain join permissions in Windows Server
  For new computer account creation: Add workstations to domain / SeMachineAccountPrivilege (quota-managed) OR explicit Create Computer Objects permission on the target OU/container; reusing a precreated object is a separate scenario.
• Microsoft · [MS-SAMR] USER_ACCOUNT Codes
  USER_WORKSTATION_TRUST_ACCOUNT = 0x80 in the event SAM User Account code set; distinct from UF_WORKSTATION_TRUST_ACCOUNT = 0x1000 in directory/data-model flags.
• Netlogon operational flow on domain members
  Member discovery, channel setup, OS-initiated periodic password change
• Netlogon common authentication details
  Client/server shared password information; no credential generator implemented
• Troubleshoot Netlogon service startup failures
  5719 secure-session setup failure, not proof of one cause
• Machine-account current and previous password history
  Current/previous history can tolerate lag; only explanatory passage consulted, reset procedures not reproduced