How to prevent a user from entering a PC into a domain?

Question

Active Directory

I did as it is written here: https://habrahabr.ru/post/174437/ (but did not touch the Default policy, but created my own side by side)

But as before, any user can add to the domain. What else needs to be configured?

Answer 1

https://support.microsoft.com/en-us/help/243327/de...

Answer 2

Only the Domain Administrator can add a PC to a domain.
Something is wrong with your permissions.

Answer 3

Purely theoretically, why is it bad that a user can enter a computer into a domain?