Stopping system changes

I have a group of users who I would like to stop making changes to their
systems, i.e. installing applications, adding hardware, changing passwords
etc etc - Is there a program that can stop this happening but if admin
require to do any of the above they can enter a password.

I am not able to set their accounts to limited because unfortunately certain
programs require administrative access.

Any hints or ideas would be much appreciative