You mean the actual user logging in?
We eventually decided to create a group were all admin users are placed in, then use User Rights Assignment GPO to add this group to the administrators.
And to prevent the administrative user to "hack" into another computer we closed all unnesecary ports on all other VM's in the VLAN. Also make sure to set the policy for the firewall so that a user can't change it, even if he is an administrator.
Because there is no way of knowing what user logs onto which machine there is no way of adding the user to the local admins group before login.
Adding afterwards is useless because permissions will only be applied after relog (which will cause the machine to refresh) but my guess is you already kewn that .