How do you allow non-Domain Admin users on a Windows domain to install EXE programs from their account?

No really; how do you do it?

I've looked through all of group policy and the closest you can get that I've seen is to allow installs with 'elevated privileges' which I then found out ONLY applies to MSI packages... not EXEs. What I really want is for whatever user is logged in to be the full local admin of the computer they are sitting at.

The trick? Do it remotely without ever logging into the remote computer locally. It would be far too annoying to go to each computer and manually specify that their user is part of the bulitin/administrators (local admins) group. Oh yeah, thats not even an option on Vista either. All remote computers have a different random password set for the Administrator.

So, without granting someone 'Domain Admin' privileges, how do I enable users to install software on their own? Currently I have to RDP to each machine every time someone wants Firefox installed! Let alone they aren't even allowed to setup a tunnel using OpenVPN's software.

So, I ask you internet, how do you make this happen?