but apparently anyone can switch the computer from a domain to a workgroup?

By default yes, but this behaviour can be changed by messing about with security policies.
_________________________
Remind me to change my signature to something more interesting someday