ANSWER:

Well, it seems that all the privileges are needed on the client side of things, so just add the student worker as a local administrator on all the machines that they’ll need access to. Give them a normal domain user account and use Restricted Groups in group policy to add the user to the local Administrators group of the client machines.

by Safado from http://serverfault.com/questions/397600