I use GPO and it doesn't need the user to have admin rights.