Windows 7 Restricting Rights

[alow]

We are trying to think of a way to give certain users the ability to install software without giving them full administrative rights. In the past, we would give their domain account local admin rights on the machine, but in lieu of that, we've been creating a separate local account that has admin rights. This works pretty well, but the user still has the ability to elevate their domain account privileges to include local admin rights if they know how to do so. So it boils down to 2 questions I guess:

1. Is there a way to configure permissions on an account so they can install software but not be able to use computer management?

2. Is there a way to create a local account on a computer that you can't actually log in to the computer with?

I intend to do some research on this, I just figured I would check in with this crowd first.

 

[EvanDavis]

This may be a long shot. But grant access to local machine with an expirey on the password ??

 

[alow]

We have the local admin accounts' passwords set up to expire the same as our domain accounts, every 60 days. The problem is that even if they have the account for 1 day, if they know how and are malicious, they can still elevate their priveleges.