Differentiate CNO - VCO from computer objects in AD.

In my attempts to distinguish between computers & VCO / CNO, the only solution I’ve is to check the [editable] description field.

another option to check the servicePrincipalName/s is there but that's again editable. In an unguarded environment any one with Admin Rights can change it. Further there's this OperatingSystem which is populated only for boxes & not for VCO/CNO.

yup