a truely easy way to see power users is more like server operators. basically, all rights they have, are a culmination of user rights assignments, registry and file/folder perms, and i think that about covers it. all of these can be adjusted. im ex-PSS from MS myself (metoring)...what they sent you is actually only partially true, as A LOT of things are hard coded to use administrator, or to deny guests, etc.
as far as elevation of rights for installs...sure, anyone can elevate, including regular users, if they know how.....
GMC43302-
Your settings should be able to be taken care of by setting an OU level policy (on the computer accounts) at computer configuration/windows settings/security settings/user rights assignment
Setting: Change the System time
Value: Remove Power Users so that only Administrators is left
once you obtain the file and registry locations, you will be able to do this properly though and send out registry and file system GPOs at the OU level (with the computers) to loosen permissions and allow the authenticated users group (if app must use local group, then users group of course)
-Brandon Wilson
MCSE:Security00/03
MCSA:Messaging00
MCSA:Security03
A+