[Samba] How do you create an accout that can ONLY add workstations to the domain

[Michael Lueck]

Is there some way to configure a special account which is able to only join workstations to the domain? I believe the operation talks over IPC$ - such as the NETDOM.EXE command. Can one set admin 
users for IPC$ and thus join the domain without allowing that special account too much access to Samba.

Maybe one extension of this would be allowing to join workstations to the domain plus read only access to a share to draw files down from while preparing the computer.

TIA!
-- 
Michael Lueck
Lueck Data Systems

Remove the upper case letters NOSPAM to contact me directly.