Win2000 Professional Rights

I have a pure Windows 2000 network. Win2000 Server, one domain, and Windows 2000 Profetional PCs logging onto to it.
Users can not load aplications on their PCs unless they are logged in as administrator?
If I add them to varios groups including administrators, then they can load applications? What am I missing?