When you set the following restrictions in Active directory, the restrictions are NOT enforced for local administrators:

Only a domain administrator can register a computer account.
Users cannot reset a computer account.
Users cannot register a computer account.

Local administrators have access to the computer account password and can reset or register the computer account in the domain.