Is it possible to give an unprivileged user the right to Run as administrator?

Question

Active Directory

There is a 2012R2 domain with Windows 7 workstations. It is necessary to give a limited number (1-2) non-privileged users the opportunity to perform administrative tasks on their computers from time to time, such as installing applications or configuring printers.
To give them the rights of the administrator on constantly does not allow conscience. It would be ideal to give the ability to run programs on behalf of a specially selected administrative account, but with a ban on this account logging into the computer. However, policies such as Deny log on locally or Deny log on through Terminal Services do not help - they also prohibit Run as administrator.
Maybe there is some kind of perpendicular approach? And then I went in cycles in it and I don’t see anything else.

Answer 1

It turns out - on computers it is necessary to make local users (not domain) - local administrators. And when prompted, enter their username/password.
And then, having these log / pass, users will change the rights to their domain accounts to local admins, even if they don’t log in under local admin accounts.