Not allowing Domain admins to log on to workstations

Hello,

I was wondering if anyone knew a policy to deny domain admins from logging on to workstations with their domain admin account. Too many problems have happened like this, since they have too much access on the domain, and can spread any virus and so on.