Look into or create an ARPRetryCount registry setting: SYSTEM\CurrentControlSet\services\Tcpip\Parameters\ArpRetryCount
It's a DWord. Set it to 0.
The 169.x.x.x addresses following a reboot should stop.
You can use the Restricted Groups policy in a GPO to add a domain group to the "Local Administrators" group on the machine receiving the GPO.
There are two modes of the Restricted Groups policy in a GPO: Accumulative or Enforced.
That's the old-school way... now you can use GPP to do the same thing.