We have done this easily. It requires just a few things. The below suggestions are based on the premise that you are running Windows 2000 or XP.
1) you need to define a list of applications that you support, applications you allow but do not support, and applications you do not allow.
You will then need to make sure that you provide patches for the application that you support that allows them to work without admin rights.
2) you will need to understand why applications need administrative rights. There are normally two reasons.
A) the software writes to restricted areas of the computer that a standard user does not have access to (Windows 2000 Logo compliance)
B) the software checks to see if the user is a member of the local administrators group. (app compat wizard can sometimes assist in spoofing the application)
3) I have found that creating local user groups and assigning certain permissions to those groups will open the computer enough to allow apps to run, but not give users too much power to edit additional settings on the computer. This is similar to just adding users to the Power Users group. I choose to add new groups instead of editing the default Microsoft groups so that I can easily identify my changes versus the default Windows groups and permissions.
Many times a Power User has the proper rights to run the software that doesn't run under User credentials. The problem with the Power Users group is that it also allows unwanted abilities that are almost as bad as giving Admin rights. Power Users can install most software, create and delete local computer groups, and install hardware or device drivers (based on built-in security principles). All of which are usually unwanted when locking a computer down.
They also allow the user to write and edit file in the following areas:
c:\
c:\program files
c:\windows
c:\windows\system32
They also have the ability to create/edit the following areas of the registry:
HKLM\Software
HKLM\Software\Classes (otherwise known as HKCR)
HKLM\System
With the above information, you can add a new local group that has permission to make the same file and registry changes as a power user, but does not get the same security abilities. Then, just add the authenticated users group to the local group. I also created a local group that has deny permissions in certain areas to prvent the user from taking ownership or deleting objects.
Sometimes we have to create special patches that open up folders, files or registries to allow software to run, but I have found this to be very infrequent.
Hope this helps!
