Add workstation to domain GPO setting

I’m a newbie on AD.  I inherited a GPO setting which I am not clear if I need to keep.

Policy:
Computer Configuration /Windows Settings/Security Settings/Local Policies/User Rights Assignment/Add workstations to domain

Policy setting:
Administrators, domain\Domain Admins

Linked to domain level

According to the MS description listed below the security setting is only valid on DCs.

Question 1:
Without this policy, don’t Domain Admins have the right by default?

Question 2:
Can I assume this policy is used for instance to allow help desk users to add new PC’s to the domain?

Question 3:
In my case, was this policy applied incorrectly at the domain level which gives everyone the right to add workstations?



*************************** MS Description ******************************

Add workstations to domain

This security setting determines which groups or users can add workstations to a domain.

This security setting is valid only on domain controllers. By default, any authenticated user has this right and can create up to 10 computer accounts in the domain.

Adding a computer account to the domain allows the computer to participate in Active Directory-based networking. For example, adding a workstation to a domain enables that workstation to recognize accounts and groups that exist in Active Directory.

Default: Authenticated Users on domain controllers.

Note:
Users who have the Create Computer Objects permission on the Active Directory computers container can also create computer accounts in the domain. The distinction is that users with permissions on the container are not restricted to the creation of only 10 computer accounts.

In addition, computer accounts that are created by means of Add workstations to domain have Domain Administrators as the owner of the computer account, while computer accounts that are created by means of permissions on the computers container have the creator as the owner of the computer account. If a user has permissions on the container and also has the Add workstations to domain user right, the computer is added, based on the computer container permissions rather than on the user right.
Start Free Trial