This requires either physical access or access over the network (i.e. VPN) The last thing you want to do is give the user admin rights, either on their own or a local account.

A Microsoft Certified System Engineer should never tell you that you have to give local admin rights for a PC to a general user. Applications can be enabled by setting registry and file permissions ...