2-Factor Tokens with Active Directory

I have been asked to setup a two-factor authentication that uses OTPs (One-Time Passwords) for a few accounts on our domain at work. We have an Active Directory domain and, although I am familiar with a lot of OTP Tokens from a user perspective, I am not familiar with the administration of such systems.

I have done some research and AuthLite looks like a pretty good simple solution (probably with a Google Authenticator or one of the tokens with a button) or perhaps RSA SecurID tokens with the RSA software. Although RSA seems like it might be expensive.

These are the considerations I am looking at in order;

1. Cost


2. Flexibility (Does not affect other users)


3. Simple setup

I was hoping to get the opinion of someone who may have setup something like this before or is more knowledgeable on the topic. Could you share an approach you took or a system you would recommend? (No detailed setup tutorials needed, I can work that out myself once we've chosen a system, but if you want to comment on the setup portion that would also be appreciated).