Re: Permissions on datastores - create snapshot but not new VM

Yes, this is techincally possible, but sounds like more of a process issue than anything Your only real option is to create a new role and assign it the permissions you desire on the storage objects you are referring to. Then assign your users/groups to this role. This works because the most specific permissions always win. See chapter 4: http://pubs.vmware.com/vsphere-50/topic/com.vmware.ICbase/PDF/vsphere-esxi-vcenter-server-50-security-guide.pdf. To be honest, I feel this is more work than it is worth. I would advise working on the process by which users provision systems.