prevent user from joining pc to domain

I found that by default any domain user can join a pc to a domain, and i want to lock it down so only domain admins can join a pc to a domain. Is there a way in group policy i can accomplish this?