We have Role\Responsibilities set that way we want.  However, we have a need for flagging a specific VM as PROTECTED, so that any user, Enterprise admin or other would not be able to delete without first removing that flag.

For example, a Root Certificate Authority best practice is to have the Root CA powered down during most of the year.  Only a few times during the year would you bring the Root CA up for maintenance for a few hours while changing keys.  For this reason, this VM will be powered down 99.99% of the time and we would like to flag it so that no-one can delete it without first removing that flag.  This is similar to the boolean value that protects Active Directory accounts from being deleted inadvertantly.

I was hoping that there would be some variable you can manually enter on the .vmx file that would protect the VM from being deleted.  Does anyone know of such a feature\flag?