MachineAccountQuota
The setting that lets any domain user create ten computer accounts. It has defaulted to ten since 2000 and is the prerequisite for several attack chains.
The intent was practical: an employee should be able to join their new machine to the domain without an administrator having to do it. The consequence is that every user can create an object with an SPN whose password they control — which is precisely the starting point several attacks need. Resource-based delegation requires a controlled account to nominate. The sAMAccountName spoofing vulnerabilities relied on creating and renaming a computer account. Shadow Credentials chains use it similarly. Almost no organisation needs the feature. Setting the value to zero and delegating join rights to a dedicated group closes several routes with one change, and is recommendation number one in any review.