It appears that my domain Win2003 AD users can add machines to the domain.
The Domain installation is default without much changes.
1) Can this be stopped
2) Is there a way to display everyone who has the ability to add a computer to the domain? I can see this with effective rights on a per user basis, I would like to find out how these machines have been getting added and stop this.