JSI Tip 7163. You cannot restrict domain users who are local administrators from resetting and registering computer accounts?

When you set the following restrictions in Active directory, the restrictions are NOT enforced for local administrators:

Only a domain administrator can register a computer account.
Users cannot reset a computer account.
Users cannot register a computer account.

Local administrators have access to the computer account password and can reset or register the computer account in the domain.