Computer join 2003 AD

[SevenSins]

AOA,

I just installed a windows 2003 with SP2 and made it a domain controller for abc.com

Everything is working fine but I noticed a simple user can add his computer using his account which is a member of domain users only, to the domain.
I want to restrict this and only have specified users or groups that can add and remove users..

I have searched and couldnot find what I was looking for.

Any help / pointers would be highly appreciated..

Regards

 

[GrimR]

Are there any strange groups the users belong to that may have Admin rights

 

[SevenSins]

no.. user is only member of Domain Users

 

[GrimR]

and is domain users a member of any admin groups?

 

[SevenSins]

member of local users group

 

[acl03]

So, how exacly is a simple user adding his/her machine to the domain?

Right click "My Computer", properties, Computer name, change button?

Or are they using some other method?



Thanks,
Andrew