Helpdesk as local admin

Hi Guys..

So what's the defined best practise regarding HelpDesk personnel be given/told local admin account names and passwords on users PC/Workstations in order to undertake routine fault finding and applications installation?

Help Desk techies also regularly inserts new workstations into the domain hence they need certain privileges to be able to make new workstations join the domain. What could be the most secure way given the fact that Servers are running Win 2k3 and client machines are a combination of WinXP and Win2k.