Prevent Authenticated user adding to domain

Hi,

      I have been trying to remove normal user's permission of joining to the domain. By default any authenticated users can join to domain for 10 times. I have removed authenticated users from group policy and added Domain Admins and a security group. I have even set the attribute ms-DS-MachineAccountQuota to 0. But users are still able to join to the domain. I have 2 domain controllers and both are in same location. Function level is windows 2008 R2. Please help.

Regards,

Emthias Abdulsalam

With Regards, Emthias Abdulsalam