In order to enable users to join computers to the domain, grant the following permissions:
- This object and all child objects
- Create Computer Objects
- Delete Computer Objects
- Computer objects
- Reset Password
- Read and write Account Restrictions
- Validated write to DNS host name
- Validated write to service principal name