In the college LAB scenario,we assign the VM to students.
The students always want to install some illegal software or game application in the VM,the teachers want to control this.
They want to control the privilege for software installation in the student VM by normal user account.
In this case ,we can assign the VM to multi-users, each VM assigned to a domain account in user group, and one domain account in administrator group for all VMs.
The students will use this domain account with user privilege to login the VM,but they don't have the privilege to install software.
The IT administrator or the teacher can use the account which has the administrator privilege to install software.