Assign Local Admin Rights without local Admin Group

Hi

We upgraded our desktops from Windows XP to Windows 7, with Windows XP we used the resource kit’s CDROMLOCK.EXE to lock down CD and DVD. Once installed a user had to be in the local administrators group to access a CD or DVD on that desktop.

For Windows 7 it is not Windows 7 compatible so I run the EXE in Vista SP-2 Compatibility mode, which works perfect.

My question: With a user in the local admin group they have access to the CD and DVD, but also have full access to the desktop, which is of concern. Does anyone know how to assign a user name (Either local Desktop or a Server 2003\2008\2010) domain account to a service or Exe?

Is there a way to either create a folder with full rights and then put the exe in the folder, giving the user full admin rights to the folder, or assign full admin rights to s single EXE file?

I am just not sure how Windows 7 controls local admin rights other than the local Admin Group.

If this is in the wrong group, please move.

Thanks

B.