MS' own advisory says you don't need physical access (only admin rights).