Corporate policy only allows users to connect corporate-issued machines to the network managed by Active Directory. Is there some means to log or otherwise detect when the same user account joins the domain with "unauthorized" machines? Suppose the user connects non-simultaneously and can rename their machine to match an "authorized" machine's name.
I assume you're concerned about Domain Users using the default privilege to add up to 10 workstations to the domain, without Domain Admin permission.
To control who has access to add users to the domain, edit this Local Security policy on the DC
Next, if you want to see who added a workstation to the domain I would suggest looking at:
Furthermore you asked:
There are two parts to this: the Kerberos impersonation and the NetBIOS impersonation. Depending on your GPO settings it may be possible for a person to rename and impersonate one or both authentication types for a given "unauthorized machine".
If the imposter can convince DNS, which is protected by an ACL, and it can edit AD (via SPNs or other administrative function), the it's possible to impersonate a Kerberos server. It's up to your application to detect this impersonation. An example of impersonation is Windows Terminal Server 2008 and newer. It will pop up a dialog box stating there is an insecure network connection.
On the other hand NTLM based authentication can have "imposters" and it's next to impossible for the client to detect this. The only defense you have is to disable NTLM and use Kerberos exclusively.
If you need to use NTLM for some hosts and not others, follow Eric G.'s suggestions
I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin privileges).
Theoretically, it's possible they could image their work machine and put it on their own hardware, but that would not allow them to change the system settings and gain more privileges, it would still generally be your GPO in affect. To counter this, a combination of TPM and encryption would help.
If you want to block unauthorized systems from joining the network, you would probably want to do this a layer domain from Active Directory at the network level. You could implement 802.1x port security or any other type of network access control (NAC).