Force USer Login when Passive Authentication is on

Hello,

I have a weird question my customer asked me:

They have a working passive authentication via Active Directory.

They asked if it is possibile for the administrator to go to a whatever computer and force his credentials to have full access without logging out and logging in with his AD credentials.

To make myself clear, he wants to force his authentication calling some kind of captive portal or telnbet/ssh login to grant him full access.

For some reason a situation similar to the URL filter override but applied to a whole policy.