I am implementing a new domain and want to tighten security on my
network, using Group policy. A number of users are local
administrators on their workstations, and log in locally, then enter
their network password only when they first connect to a network
resource, they participate in the network even through they are not
part of the domain.

I want the users to be part of the domain, how can I require them to
join the domain? If I add the computers they are likely to remove them
from the domain again so I am interested in a way of tightening
security to force them to stay part of the domain.

The domain is native 2000/2003. Any help is much appreciated.