A library domain allows excessive machine-account creation or join rights for ordinary users. Why does that matter conceptually?
Select an answer to reveal the explanation.
Short Explanation
Letting everyone mint new computer accounts is like handing out unlimited building badges. Extra machine identities can become stepping stones. Cap those join rights unless there is a real business need.
Full Explanation
Defaults or misconfigurations that let broad user sets create many machine accounts expand opportunities for abuse in AD attack paths. This is a recognized misconfiguration class rather than a cosmetic inventory feature. Join rights are not limited to screensaver behavior, and the finding is possible in real deployments. Testers should report excess machine-account rights in the context of identity risk and least privilege.