You need to ensure that any computer that is added to the domain by any user receives settings specified by the Baseline GPO
You need to ensure that administrators can access domain controller console sessions locally and not remotely