diff --git a/nns/nns_contract.go b/nns/nns_contract.go
index d1057513..152a6fd0 100644
--- a/nns/nns_contract.go
+++ b/nns/nns_contract.go
@@ -297,6 +297,10 @@ func Register(name string, owner interop.Hash160, email string, refresh, retry,
 		if parentExpired(ctx, 1, fragments) {
 			panic("one of the parent domains has expired")
 		}
+		parentKey := getTokenKey([]byte(fragments[1]))
+		nsBytes := storage.Get(ctx, append([]byte{prefixName}, parentKey...))
+		ns := std.Deserialize(nsBytes.([]byte)).(NameState)
+		ns.checkAdmin()
 	}
 
 	if !isValid(owner) {
diff --git a/tests/container_test.go b/tests/container_test.go
index 4dcd5e58..2c323d9c 100644
--- a/tests/container_test.go
+++ b/tests/container_test.go
@@ -136,7 +136,7 @@ func TestContainerPut(t *testing.T) {
 			c.id = sha256.Sum256(c.value)
 
 			t.Run("bad domain owner", func(t *testing.T) {
-				tx = PrepareInvoke(t, bc, acc, nnsHash, "register",
+				tx = PrepareInvoke(t, bc, []*wallet.Account{acc, CommitteeAcc}, nnsHash, "register",
 					"baddomain.neofs", acc.Contract.ScriptHash(),
 					"whateveriwant@world.com", int64(0), int64(0), int64(0), int64(0))
 				AddBlockCheckHalt(t, bc, tx)
diff --git a/tests/nns_test.go b/tests/nns_test.go
index 95c2b283..665b3373 100644
--- a/tests/nns_test.go
+++ b/tests/nns_test.go
@@ -65,9 +65,10 @@ func TestNNSRegister(t *testing.T) {
 	bc := NewChain(t)
 	h := DeployContract(t, bc, nnsPath, nil)
 
+	accTop := NewAccount(t, bc)
 	refresh, retry, expire, ttl := int64(101), int64(102), int64(103), int64(104)
-	tx := PrepareInvoke(t, bc, CommitteeAcc, h, "register",
-		"com", CommitteeAcc.Contract.ScriptHash(),
+	tx := PrepareInvoke(t, bc, []*wallet.Account{CommitteeAcc, accTop}, h, "register",
+		"com", accTop.Contract.ScriptHash(),
 		"myemail@nspcc.ru", refresh, retry, expire, ttl)
 	AddBlockCheckHalt(t, bc, tx)
 
@@ -75,6 +76,12 @@ func TestNNSRegister(t *testing.T) {
 	tx = PrepareInvoke(t, bc, []*wallet.Account{CommitteeAcc, acc}, h, "register",
 		"testdomain.com", acc.Contract.ScriptHash(),
 		"myemail@nspcc.ru", refresh, retry, expire, ttl)
+	AddBlock(t, bc, tx)
+	CheckFault(t, bc, tx.Hash(), "not witnessed by admin")
+
+	tx = PrepareInvoke(t, bc, []*wallet.Account{accTop, acc}, h, "register",
+		"testdomain.com", acc.Contract.ScriptHash(),
+		"myemail@nspcc.ru", refresh, retry, expire, ttl)
 	b := AddBlockCheckHalt(t, bc, tx)
 
 	tx = PrepareInvoke(t, bc, acc, h, "getRecords", "testdomain.com", int64(nns.SOA))