Allow domain user to install programs for users

Question

Active Directory

There is a domain user, he needs to be allowed to install programs on users' computers, but not allowed to manage the domain (climb into group policies, add, delete, change passwords for users, add workstations to the domain, assign groups to users)
Is this real? (DC and BDC - 2003R2)

Answer 1

Using Group Policy, add a specific user to the list of local administrators on workstations.
Look towards Restricted groups.