Deny logon to server from any user OTHER than Administrator

This may seem basic, but i am just drawing a blank here. I have a user who needs to install programs on computersi n a domain, BUT I do not want this user to be able to A) logonto the server locally, B) not be able to map to a hidden share on another computer.

Running Server 2003 SBS.

I currently have this user in the Domain Admin group so she can install programs. I want to put her in the Domain Power user group. Is this my solution, or does anyone recommend a better way. OR if anyone can direct me to some white papers or such regarding the permissions functions in detail, that would be great as well.

Thanks for any help you may be able to provide. =]