How to stop users from changing their computers from domain to workgroup

I am having a problem with some users that are using tools like winternals etc to gain access to their local admin user account on windows xp and then using that to take their machine off of the domain.

How can I stop them from being able to do that?

Will they be able to do that with windows seven machines?