Forefront : enable FCS client to change settings

When setting up Forefront policies you may want to let some users/computers paremeter their Forefront client on their own.
I thought that enabling the "Only administrators can change Client Security agent settings" would work as each user is in the administrator group of his machine.



This doesn't work unless you change the protection settings (virus/spyware protection) and set them to User controlled :


This will allow users to set their own schedule.
If you want to set the default scheduled scan (everyday 2AM) to another value, change it while Virus protection is set to on and before changing it to User controlled.