We are trying to prevent users from willy-nilly joining VMs and outside machines to our domain. The default is any user can join up to 10 machines. Is there a way to limit this to only Account Operators, Domain Admins, and Enterprise Admins?
I believe what you're looking for is referenced in these two MSKB articles:
- Default limit to number of workstations a user can join to the domain
- Domain Users Cannot Join Workstation or Server to a Domain (where to look)
The first article gives the details on where to go in Adsiedit.msc to change the default value (Domain NC, pick the right item, Properties, view ms-DS-MachineAccountQuota, edit attribute to change the value).
I've also seen a mention that there's a Group Policy under Default Domain Controllers Policy\User Rights Assignment but I'm not at a good spot to go digging for it to verify.
Have you looked at this:
There is a group policy that can change who has the right to add machines to the domain. I'm not in front of a server at the moment but if I remember correctly this can be changed easily.
KCotreau's answer shows the group policy changes I mention in detail.