Active directory

Anyone here fluent in AD? I am working on a DC that I have created for my local network and another remote network.

Right now the layout is three workstations locally here at my location, and up to 5 workstations at the remote location. The two are tied together via VPN, with the DC residing at my location. There is currently one member server here, but in the future there is one planned for the remote location.

What I want:

What I am looking for is a security policy that still allows functionality on the computer. This would include the ability to install programs, without being part of the administrator or domain admin group. I think I can figure out everything else but this component is driving me crazy. Any help? Any other suggestions that you or others know of to make the domain a bit more user friendly but still secure?

The ability to install programs requires the ability to modify the registry. I don't think there is a way around it. The users who need this would have to local administrators. For security, you could then make a gpo in the ad to reduce what the users can do . I may be wrong but thats my understanding of windows permissions.

Hmmm. I was afraid of this. Doing such, I might as well make them admins. Thanks!

go under administrative templates
its in there, just dont remember exactly where.