Disable domain join unless computer account has first been created

Question

Anyone know if its possible to configure Active Directory so that a computer cannot be joined to the domain unless the computer account is first created manually

Answer 1

Hi Meinolf,
while you are right with a Domain user can join up to 10 Computers to a Domain, that is not exaktly what happened.
Even if a user may join a new computer, this only and only is possible in case the user is allowed to write to the corresponding OU / Container, where the account needs to be created.
A join will fail if the user cannot create the computer account object. The statement is not correct in this way from an end (Computer) to end (Computer object) view.
If you worked with pre-populated Computer objects, the 10 Computer Limit is also obsolete. When you create the object you are (GUI) asked "who can join that Computer to the Domain?". If you are a member of the group put in that Dialog, there is no 10 computer
limit. You will be able to join as many Computers, as needed.
The 10 computer limit per Account is only and only valid if you did not prepopulate the object AND you have access to create a new computer account at the default OU for new computers. This is working for AD Windows Server 2003 up to AD DS Windows Server
2012 R2.
http://support.microsoft.com/kb/243327/en-us 
http://blogs.technet.com/b/kevinremde/archive/2013/10/30/what-s-new-for-active-directory-in-server-2012-r2.aspx
Kind regards,
Martin