If you restrict users, you aren't going to be able to install most applications without logging in to the computer as local administrator or as another user that has elevated privileges. The quick and easy way to do that is to start the setup program using Secondary Login, which is better known as Run As. Right-click the setup program while holding down the Shift key; then click Run As and type your credentials.
There are other methods, particularly if you're talking about automated deployment of applications that require elevated privileges to install. For example, Microsoft's SMS was made for this scenario. Any program you deploy via Active Directory installs with elevated privileges, as well. Tools such as AutoProf Profile Maker make installing programs with elevated privileges much easier.
This was first published in March 2003