Windows local admin rights best practices

Windows local admin rights best practices

We are running our company network with a few 2008 R2 AD server and
windows 7 workstations. Our users do not have local admin rights our their
computers, hence, the IT departement is required each time :
a user needs to install an application
java needs to upgrade for example ...
Here is what i think :
i think we should be able to deploy some apps using GPO
for this scenario, i really don't know ...
What are the solution to handle this smoothly ? It would be nice to have a
one-time admin password for example ...
Thanks !