Here’s one that took a little finding, hope it may be useful to someone.
In this case, Domain policy was that no user may have administrative access to their pc, however a user needed to have the ability to change their network settings (from a switched to a fixed IP) for certain work related activities..
This seemed to do it.. login to local machine with domain admin account & …:
control panel>user accounts>manage user accounts>advanced tab>advanced> groups> select ‘network configuration operators’, add> domainusername, and reboot.