Active Directory Cookbook for windows server 2003- P49:If you are familiar with the O'Reilly Cookbook format that can be seen in other popular books, such as the Perl Cookbook, Java Cookbook, and DNS and BIND Cookbook, then the layout of this book will not be anything new to you. The book is composed of 18 chapters, each containing 10-30 recipes for performing a specific Active Directory task. Within each recipe are four sections: problem, solution, discussion, and see also. | Recipe Creating a Quota P This recipe requires a Windows Server 2003 domain controller. Problem You want to limit the number of objects a security principal can create in a partition by creating a quota. Solution Using a command-line interface dsadd quota -part PartitionDN -qlimit QuotaLimit -acct PrincipalName RETURN -rdn QuotaName The following command creates a quota specification that allows the RALLENCORP raiien user to create only 5 objects in the dc rallencorp dc com partition dsadd quota -part dc rallencorp dc com -qlimit 5 -acct RALLENCORP rallen Discussion Quotas are a new feature in Windows Server 2003 that allow an administrator to limit the number of objects that a user or group of users can create. This is similar in nature to the quota for creating computer objects found in Windows 2000 see Recipe for more details except the quotas in Windows Server 2003 apply to the creation of all object types. There are three things that need to be set when creating a quota specification including Partition Currently quotas can apply only to an entire partition. You cannot create a quota that pertains only to a subtree in a partition. You can create quotas for any partition including application partitions except for the schema-naming context. The reasoning behind this restriction is that the schema is a highly protected area of the directory and you shouldn t need to restrict how many objects get created there. Target security principal A quota can be defined for any type of security principal. The msDS-QuotaTrustee attribute on the quota object stores the target principal in the form of a SID. 491 Limit This determines how many objects the target security principal can create. The quota limit is a combination of the new objects that a user creates plus any tombstone objects that are created by that user. If a user creates an object and then deletes another object that would count as 2 toward any quotas that apply to .
