If it's NOT a domain controller, then sure, they can set her up with the Log On Locally user rights assignment (https://docs.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/allow-log-on-locally). They still may need to spend some time securing any files that she shouldn't have read or write access to, but full admin permissions are not required. If it is a domain controller (which is officially not a supported platform for Sage 100), then they're right, she'll need Admin rights.