Users have the ability to add themselves to the Domain Admins group, granting them Domain Admin privileges.

Question

All users created in Active Directory are able to add themselves to the Domain Admin group, granting themselves Domain Admin privileges.

Users can log into the Domain Controller, access Active Directory, and add themselves to the Domain Admin group.

I tested this issue, removed unnecessary permissions from the Domain Admin group, but upon checking today, all the permissions have been restored.

Can you help me understand why this is happening and how to resolve it?