I would say that either logging in as an administrator or having a separate password would work equally well for me. I would say that a separate password might be better because I tend to give the user who the computer is used by local admin access and then that would defeat my purpose.

I am not sure if this is already a feature or not(if it is I cannot figure out how to make it work), but it would be nice if the connection could be established at computer startup before login, as I use an AD server and I would like users to authenticate and retrieve the latest policies upon login ...