It depends on what exactly you want the users to do.

For example if you wanted the user to install apps, so that the admin does not have to go round to each machine then assign / publish the software via a Group Policy. By default you have then given the user the right to install that software onto their machine without having admin. rights. Link the Group Policy to the domain container.

Bear in mind that any OUs can block policy inheritence and this could stop the install, however if you set the policy linked to the domain then set no override to install


Hope this helps

variable