We want allow only specific security group and domain admins to join copmuters to domain. Not only join, but also remove, rewrite existing, rename, move to another domain. So all other users are restricted for these operations. I searched for solution and found that there are several ways to grant permissions, and to restrict. I chose to delegate security settings on "computers" container, where new computers come. So to restrict user to join domain, I select "authenticated users" in security tab of "computers" container and deny to create and delete. Then, I select my specific security group and allow them to create and delete computer objects. But the point is that there are about 5 "autenticated users" groups. Which one to choose?
And we also suffer from some mistakes that appears after joining to domain computer that already exists. After overwriting copmuter object some group policies doesn't apply. So to work it correctly we need first to delete computer from AD, and only then join it.
And actually I wanted to ask best practices to accompish this task. Now we have default "computers" container where new computers come, and we have OU where we mannualy move new computers from default container.