content: So basically it allows you to join machines to the active directory domain without possessing any administrator credentials. Maybe then transfer fsmo roles and replicate incorrect data to the dc. In which case, it's going to deauthenticate every machine with cached credentials and throw a loss of trust. More of a nightmare scenario for your IT guy than a realistic attack vector.