Default AD (in?)security

I'm looking at closing what I beleive to be a security 
issue by changing a default value in AD that allows 
authenticated users to add (up to) 10 workstations to a 
domain.
The ms-ds-MachineAccountQuota attribute of the DC by 
default is set 10.  I would like to change this value to 0.
Has anyone done this?
Does this change affect any users that by Policy (via 
the "add workstations to domain" permission or inherent 
rights (such as administrators) already have the ability 
to add workstations to a domain?