You need to add that domain users account to the local administrators group
for the domain computers. That can be done with a Group Policy startup
script and the net localgroup command or with Group Policy Restricted Groups
where you can create a global group for such purpose and the domain users to
that global group. The use Restricted Groups and the "member of" [for SP4]
option to make it a member of administrators group. You must do such at the
Organizational Unit level because if you do it at the domain level then that
group will be a member of the administrators group for the domain.
Restricted Groups can be found under computer configuration/Windows
settings/security settings. The link below explains more. --- Steve
