Users on domain who can install software, but not access AD

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

I would like to create a security group, that I can include users into, so
that these users can be on any workstation on the domain and install
software, but they cannot add users, or add computers to the domain without
an Administrators intervention. So I have four contractors coming in, they
will be touching each desktop and laptop on the domain to run updates and
remove and install software, but I don't want them to have access to the
servers, so no domain admin rights. How can I do this?

Thanks ahead of time.