[Policy] AllowLockdownPatch [Value data type] REG_DWORD [Description] 
If this per-machine system policy value is not set, only administrators can patch existing products that were installed at elevated privileges. If this policy value is set to 1, non-administrative users can, in some cases, apply patches to products while running an installation using elevated privileges. With the policy set, the patch can install minor upgrades while running an installation using elevated privileges; the patch cannot install major upgrades. Setting this policy also enables non-administrative users to run programs at LocalSystem privileges during an elevated installation.