changing group membership if working in cached mode

Hi,

We have a number of users with laptops who travel. The laptops are
joined to the domain and when the users travel, the laptops use cached
credentials for login. This all works fine.

We'd prefer that these users not be local admins, but sometimes when
they travel they need to install software or do troubleshooting that
requires they be local admins. Naturally, we don't want to give them
the password to the local admin account.

Is there a way to change their group membership when using cached
credentials?

The goal is that when the user is offline/traveling the user is a
member of the admin group, but as soon as the computer logs into the
domain when the user is back in the office, the user is removed from
the admin group.

I could script this pretty easily and just have a task that runs every
hour that checks to see if it can find \\localservername or something
similar that it can only do when actually on the domain, and then
remove or add the user to the group as appropriate. Set the script to
run as either system or the local admin and it should be fine. But it
would be nice if there were an "official" best-practice way to do it.

Thanks,