Question: I have a specific OU with several machines in it.
I just created a domain-user who is meant to have normal standard-rights like an absolutely normal local-user on all the machines - the only thing he needs to be able to do, is installing any kind of software he wants, but **without** being either a domain or a local Administrator at the same time.

I thought maybe I could realize this, using a GPO for that user but I haven't come very far yet.

Is there a way to give the newly created user the permission of installing things on machines being located in that specific OU, without giving him all the other administrator-rights?

Answer: 
Well, two approaches here: 

* You've to be local administrator to install software, there's no "Installing software delegation". But the good news is you can do that with a GPO, using Restricted groups: <http://social.technet.microsoft.com/wiki/contents/articles/20402.active-directory-group-policy-restricted-groups.aspx>
* You can use a GPO to "Publish software": opposed to "Assign software", which will force an installation of a given software to the computers affected by that GPO, "Publish software" will allow any user logged on a computer affected by the GPO to install the software you've, well, published in that GPO:
<https://support.microsoft.com/en-us/help/816102/how-to-use-group-policy-to-remotely-install-software-in-windows-server-2008-and-in-windows-server-2003>

Pros and cons: first option gives the user too much power, but he may install whatever he needs to; second option gives no power to the user, but you'll have to do extra work to publish any software he needs. And it's to come in MSI format!
One way I've done it is create security groups. I have a Local\_Admin security group on the domain that is put in the local Administrators group on all computers. Then you can move a user in and out of that security group, have them log off/on, do what they need, then remove them from the group. It gives them local admin rights so they can modify the machine. Here's one website with instructions on what I'm talking about. Different application but the process is the same.

<https://community.spiceworks.com/how_to/907-gpo-to-push-out-local-administrators-across-a-domain>