As we saw earlier the “Virtual Machine User (Sample)” role allows for basic actions on the VM such as power on/off and opening a console. It does also allow for user to connect floppy drives and CD-ROM devices. As an example we are going to create a custom role that denies that specific privilege and reassign it to the VM Folder. By far the easiest way to create a new role is find one that closely matches your requirements first, and then clone it – and modify the custom role.
For more information on Creating Custom Roles – See the VMUG wiki…