It seems a simple question but I can't find the answer on Google or Windows support pages/forums.
If a domain administrator decides to remove the automatic right for domain users to be able to add up to 10 computers to a domain using the 'add workstations to domain' right then how does Active Directory know when one of those actual computers is attached/attaching? I'm assuming it's not just based on name as it is easy to rename your computer to anything so that would easily defeat the security control of denying the user the ability to add new computers (i.e. computer accounts) by just renaming a new computer to the same as an already authorised one.
Does this computer verification require a predefined key or token to be present on the computer attaching to the domain?