Is it possible to limit who on an AD domain can join computers to the domain?

Solution 1:

Go into your Domain Security Policy>Local Policy>User Rights Assignment and change the "Add workstations to domain" to just the groups you want.

Solution 2:

I believe what you're looking for is referenced in these two MSKB articles:

• Default limit to number of workstations a user can join to the domain
• Domain Users Cannot Join Workstation or Server to a Domain (where to look)

The first article gives the details on where to go in Adsiedit.msc to change the default value (Domain NC, pick the right item, Properties, view ms-DS-MachineAccountQuota, edit attribute to change the value).

I've also seen a mention that there's a Group Policy under Default Domain Controllers Policy\User Rights Assignment but I'm not at a good spot to go digging for it to verify.