Permissions themselves are not hierarchical in Windows so you can't assign a right based on the 'level' of a user. They are individual permissions that are assigned to a resource for each user. A Venn diagram is a good analogy - if a user falls into the right circle he/she can perform the associated action.
In More Detail
In Windows, each resource (file, process, registry entry, etc.) has an Access Control List (ACL) with one or more entries that defines which users have which permission on the resource. Furthermore, you can (and should) assign the permission to a group and add the user to the group.
An administrator is simply a user who belongs to a group (Administrators) which by default has all permissions on all resources (well, most actually, but that's another post).
There are other default groups which have a subset of those permissions which might fit your requirement:
Local groups: https://technet.microsoft.com/en-us/library/cc771990(v=ws.11).aspx
Active Directory groups: https://technet.microsoft.com/en-us/library/dn579255(v=ws.11).aspx
You can also create your own groups that have a subset of the permissions assigned to a subset of the resources: https://technet.microsoft.com/en-us/library/cc754344(v=ws.11).aspx
There are many nuances to setting permissions so that they (1) have the intended effect, and (2) are maintainable and I strongly recommend reading some best practices before getting too far into it, but some general pointers for NTFS permissions are:
- add users to groups and assign permissions to the group (not to the user!)
- use nested groups for better organization, for example U:BSmith -> G:Accounting -> G:PayrollUsers -> ACL
- give groups the least privilege they need to do the job defined by the group
- Permissions are additive. I.e. if a user belongs to two different groups they will be allowed to do anything either group can do.
- Deny permissions override allow permissions. I.e. if a user belongs to two different groups they will be allowed everything either group can do, minus anything either group is specifically denied.
If you are doing anything mission critical I would strongly recommend getting someone with experience to help you. There are many ways to cause unintended side effects.