W2K Pro clients in NT Server 4.0 Domain

I have several W2K Pro SP4 client computers in a NT Server 4.0 Sp6a domain.
The problem i have is that the w2k pro computers dont run some application programs nor simply allow the user to change their desktop setting, taking a high security configuration automaticaly. Add the domain user group to the local administrators group resolve the problem but give administrative privilegies to the local users. The local power user group function like a normal user too.
How can i give compatibility security privilegies to the users without give administrative privilegies ? Thanks.