I still did not get how user can disable or connect device to VM if he is using RDP or SSH and has not any access to vCenter console. is this :"
isolation.device.connectable.disable = "TRUE"
isolation.device.edit.disable = "TRUE" "
can be used if the user has rights on vCenter to edit VM settings ?