That situation pretty strictly supersedes Administrator access, but can be blocked by Bitlocker or other full-volume encryption (where TPM is used and you don't have the key), especially if Secure Boot is also enabled and can't be disabled. Nothing a non-admin can do will modify the OS boot process, unless the user has physical access to the machine and the ability to modify the boot disk offline.