User permissions in Active Directory

This is probably a simple one. I have an active directory domain to which users log on. What I am trying to do is give users standard “domain user” rights on the AD domain, but allow these users “Administrator” rights on their respective workstations. I’m sure there are a few ways to do this, but I’m haveing trouble figuring out exactly how to do it. My preferred method would be to create an AD group policy that allows administrative rights on the local workstation, but standard “domain user” rights on everything else. I would appreciate any help you can offer.
Thanks