I think that you also need an admin password, which can be an issue for users who don't control their machines. (My work distributes Macs with users configured to be admins, but on Windows machines only allows standard users, so I assume that it's only a matter of time until they change policies and this bites me.)