Resource-Based Constrained Delegation (RBCD) - Add Computer

Create a computer account whose credentials and SID are controlled by the operator, for later use in an RBCD workflow. Creation succeeds only when the account has remaining ms-DS-Machine-Account-Quota allowance or delegated rights to create computer objects in the target container; a configured quota value alone does not prove that allowance remains, and a zero quota does not remove delegated creation rights. This step does not grant the new account access to a target computer's msDS-AllowedToActOnBehalfOfOtherIdentity attribute. Configure that separately with authorized write access. Before using the new account for S4U, verify it has the required SPN: LDAP-based creation methods commonly set SPNs, while SAMR creation does not necessarily do so.