Document how to disable the console interfaces on hosts which do not function as a domain controller

I set up a domain with two hosts. I would expect that I would be able to access the management consoles
on only the host where I have my domain controller running.
I was able to load the management console on the second host where I was able to manage the servers running on that particular host.
Is this the expected behavior?
Can we document how to disable the consoles on hosts which do run function as the domain controller?