MMC Snap-ins

I have a W2K network that is currently undergoing an AD rollout and have remote XP users that have a locked down environment, I am looking for some GPO examples to let the users olg in locally with lite admin rights to install updates and devices without letting them have full reign of the machines….any suggestions??