Deploy .net 4 via Active Directory group policy or WSUS

My first recommendation is that you wrestle those admin rights away from users. It'll make your life so much easier in the end. SO MUCH EASIER! Users have a tendancy to really mess up their computers when they're admins...Viruses, spyware, toolbars, junky freeware, change this settings, delete this file...just don't deal with it.

That being said, if you really have to give users admin rights, you can easily create a domain user which has local admin rights on each PC. Start by creating a user in AD. Then create a group policy and apply it to all workstations. In this group policy drill down to this:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups

Add a new restricted group and make sure Domain Admins and the user you just created are members of it. This will not allow you to add any other local admin to these machines but will simply accomplish what you desire to do.

You can use Group Policy Preferences to update the Built-in\Administrators groups on the local computers with whatever domain accounts\groups that you'd like. This will not replace existing groups\users unless you explicitly check the option to remove all other group members.

Restricted Groups is the old-school way to do it. GPP is the new, more flexible way.