Default domain permissions on who can join a workstation to the domain

Apologies if this was obvious to anyone but me, but I stumbled upon the
following while researching a problem:

http://tinyurl.com/6kdjh

Apparently, the default behavior in a Windows 2000 and 2003 Active
Directory is that any authenticated user has the ability to join
computers to the domain up to 10 times. Upgrading your domain from NT
4.0 to 2000 actually seems to open up a security attribute, rather than
lock it down further. Why this isn't made a bit more obvious is beyond
me. I've been doing this gig for 10 years (well, Win2k for 5 obviously)
and I've never heard this mentioned anywhere, even among my peers and
colleagues, or at the many conferences I've attended over the years.

--
NTBugtraq Editor's Note:

Most viruses these days use spoofed email addresses. As such, using an 
Anti-Virus product which automatically notifies the perceived sender of a 
message it believes is infected may well cause more harm than good. Someone who 
did not actually send you a virus may receive the notification and scramble 
their support staff to find an infection which never existed in the first 
place. Suggest such notifications be disabled by whomever is responsible for 
your AV, or at least that the idea is considered.
--