Any user can bind and unbind a computer in 10.5????

:question: I am setting up a 10.5.6 server for testing and I was a bit amazed that an account with no administrative privileges (as specified in WGM > Accounts > Administration Capabilites > None) can bind a computer to an OD domain, as well as unbind it??? In Tiger you could specify the administrative rights for an account and limit it to user, groups, or computers. Where is this feature buried in 10.5.6? I know I'm blind and I need to step away from the computer and it's most likely really obvious, but a search of the manuals and on-line has revealed nothing...