MAC / AD integration / Security

I have recently implemented a Mini Mac Server and binded OD with AD. I have end users using MAC's to login using their AD user account. The problem I'm facing is, those end users are not able to do any of the following: Manage their print jobs Run Software Updates Open documents from SAP - it's trying to create a temp directory on their local disk and being denied If I give the end users Admin rights or supply them with the Administrator password those same items all work. We're not going to do either of those things, but would rather fix the issue without giving them Admin rights. How can I allow the end user to use their AD logins and security associated with them to allow them to do the 3 items listed above? On a side note - is it possible to push AD Group Policy to those MAC's/End Users? Regards, Mike