samba - Mar 2007 - To set up Administrator User with no Session Enabled

Hi, 

I'm using OpenLDAP + SAMBA, roaming profiles + folder redirection.

I want my "Domain Users" to be able to install software in the
machines
so I would like them to execute the instalation programas as another
user with administration privileges, but I don't want this user to be
able to logon into the domain, i mean, to open a Windows session.

The idea is that people use the "Execute as..." from the right buton
click menu in Windows.

So I need the way of having this user activated for execute software but
not available to open a windows session.

Any help?

Thanks.