domain users as local admins?!

Where I work, we give domain users local administrator rights. This is done to enable the users to run updates to the Novell client and to install Norton antivirus.

My contention is that this is a really bad idea, begging to be expoited. We’re moving to the XP and 2000 platform now where we’ll have the ability to push software using the runas command, so I’m looking to get rid of this gaping security hole.

I’m sure others have had this problem. Any suggestions/advise/comments? Thanks much.