Hello,

I have AD domain and 100 users, 15 of them are developers.
Developers need full control over their machines. They need to
install software they need without administrator perticipation.

I do not want to add them to Domain Admins group, however
adding them to local Administrators group on their PCs doesn't
solve the problem.

I heard there is a way to modify permissions on some special registry
hives and system folders (Program Files and %SystemRoot%), creating
a domain group, let's say, SoftwareInstallers and assign these permissions
to this group.

Is there a better way to do that? Or, anyway... what should I do to
make it work?

Thanks in advance