Windows 2k/XP Installation rights as a non-administrator over a domain problem

[zjbooks]

I'm pretty new to windows 2000 and work for a relatively small company where some users use their home computers on our domain and at home (they are their own laptops - not the company's).

What I want to do is have some laptop users be able to install programs on their domain profile, without having domain admin rights. How can this be done? If I have them as domain users, they can't install programs on their own machines. If I install them as domain administrators they can install programs just fine but the domain's security is comprimised, and to my boss and myself this is unacceptable.

I checked under local security policies etc and haven't been able to find a solution to my problem. Also we just employed a user who uses XP, I'm assuming (probably naively) that the security structure of XP is similar to that of 2000. If there is a huge difference please let me know.

I really do not want the users to have 2 different profiles (our work domain, and their local computer) as this is confusing to them, and makes it more difficult for them to work, if they take work home.

 

[Woodchuck2000]

Since the laptops belong to the users, I assume that they have local administrative rights. Why can't they install the software as the local admin? This would (by default) create the icons in the local "All Users" profile, and would therefore be visible to any domain users logged on to the laptop.

The only way I can think of to allow domain users to install software is to create a new group and assign it the necessary permissions to install software. Inside the "domain security policy" tool, there are an awful lot of rights that can be assigned and I'm pretty sure that the right combination will work the way you need it to.

I would recommend the first option. I don't know how to do the second one off the top of my head, but I could probably look it up...