diff --git a/accounts/migrations/0004_userinstance_is_vnc.py b/accounts/migrations/0004_userinstance_is_vnc.py
new file mode 100644
index 0000000..9c1c9b8
--- /dev/null
+++ b/accounts/migrations/0004_userinstance_is_vnc.py
@@ -0,0 +1,19 @@
+# -*- coding: utf-8 -*-
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('accounts', '0003_usersshkey'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='userinstance',
+            name='is_vnc',
+            field=models.BooleanField(default=False),
+        ),
+    ]
diff --git a/accounts/models.py b/accounts/models.py
index 15cedee..20efc6f 100644
--- a/accounts/models.py
+++ b/accounts/models.py
@@ -8,6 +8,7 @@ class UserInstance(models.Model):
     instance = models.ForeignKey(Instance)
     is_change = models.BooleanField(default=False)
     is_delete = models.BooleanField(default=False)
+    is_vnc = models.BooleanField(default=False)
 
     def __unicode__(self):
         return self.instance.name
diff --git a/accounts/templates/account.html b/accounts/templates/account.html
index b6a8b6c..c8d8c19 100644
--- a/accounts/templates/account.html
+++ b/accounts/templates/account.html
@@ -29,6 +29,7 @@
                                     <tr>
                                         <th>#</th>
                                         <th>{% trans "Instance" %}</th>
+                                        <th>{% trans "VNC" %}</th>
                                         <th>{% trans "Resize" %}</th>
                                         <th>{% trans "Delete" %}</th>
                                         <th colspan="2">{% trans "Action" %}</th>
@@ -39,6 +40,7 @@
                                         <tr>
                                             <td>{{ forloop.counter }}</td>
                                             <td><a href="{% url 'instance' inst.instance.compute.id inst.instance.name %}">{{ inst.instance.name }}</a></td>
+                                            <td>{{ inst.is_vnc }}</td>
                                             <td>{{ inst.is_change }}</td>
                                             <td>{{ inst.is_delete }}</td>
                                             <td style="width:5px;">
@@ -57,6 +59,15 @@
                                                             <div class="modal-body">
                                                                 <form class="form-horizontal" method="post" action="" role="form">{% csrf_token %}
                                                                     <input type="hidden" name="user_inst" value="{{ inst.id }}">
+                                                                    <div class="form-group">
+                                                                        <label class="col-sm-4 control-label">{% trans "VNC" %}</label>
+                                                                        <div class="col-sm-6">
+                                                                            <select type="text" class="form-control" name="inst_vnc">
+                                                                                <option value="">False</option>
+                                                                                <option value="1" {% if inst.is_vnc %}selected{% endif %}>True</option>
+                                                                            </select>
+                                                                        </div>
+                                                                    </div>
                                                                     <div class="form-group">
                                                                         <label class="col-sm-4 control-label">{% trans "Resize" %}</label>
                                                                         <div class="col-sm-6">
diff --git a/accounts/views.py b/accounts/views.py
index d2893bb..3b6a63e 100644
--- a/accounts/views.py
+++ b/accounts/views.py
@@ -151,11 +151,13 @@ def account(request, user_id):
             return HttpResponseRedirect(request.get_full_path())
         if 'permission' in request.POST:
             user_inst = request.POST.get('user_inst', '')
+            inst_vnc = request.POST.get('inst_vnc', '')
             inst_change = request.POST.get('inst_change', '')
             inst_delete = request.POST.get('inst_delete', '')
             edit_user_inst = UserInstance.objects.get(id=user_inst)
             edit_user_inst.is_change = bool(inst_change)
             edit_user_inst.is_delete = bool(inst_delete)
+            edit_user_inst.is_vnc = bool(inst_vnc)
             edit_user_inst.save()
             return HttpResponseRedirect(request.get_full_path())
         if 'add' in request.POST:
diff --git a/instances/templates/instance.html b/instances/templates/instance.html
index c3baecc..36e7afa 100644
--- a/instances/templates/instance.html
+++ b/instances/templates/instance.html
@@ -477,11 +477,15 @@
                                                         {% trans "Autostart" %}
                                                     </a>
                                                 </li>
+                                            {% endif %}
+                                            {% if request.user.is_superuser or userinstace.is_vnc %}
                                                 <li role="presentation">
                                                     <a href="#vncsettings" aria-controls="vncsettings" role="tab" data-toggle="tab">
                                                         {% trans "VNC" %}
                                                     </a>
                                                 </li>
+                                            {% endif %}
+                                            {% if request.user.is_superuser %}
                                                 <li role="presentation">
                                                     <a href="#clone" aria-controls="clone" role="tab" data-toggle="tab">
                                                         {% trans "Clone" %}
@@ -551,6 +555,8 @@
                                                     </form>
                                                     <div class="clearfix"></div>
                                                 </div>
+                                            {% endif %}
+                                            {% if request.user.is_superuser or userinstace.is_vnc %}
                                                 <div role="tabpanel" class="tab-pane tab-pane-bordered" id="vncsettings">
                                                     <p>{% trans "To set console's type, shutdown the instance." %}</p>
                                                     <form class="form-horizontal" method="post" role="form">{% csrf_token %}
@@ -643,6 +649,8 @@
                                                     </form>
                                                     <div class="clearfix"></div>
                                                 </div>
+                                            {% endif %}
+                                            {% if request.user.is_superuser %}
                                                 <div role="tabpanel" class="tab-pane tab-pane-bordered" id="clone">
                                                     <p style="font-weight:bold;">{% trans "Create a clone" %}</p>
                                                     <form class="form-horizontal" action="" method="post" role="form">{% csrf_token %}
diff --git a/instances/views.py b/instances/views.py
index 0109631..4d29df8 100644
--- a/instances/views.py
+++ b/instances/views.py
@@ -260,7 +260,7 @@ def instance(request, compute_id, vname):
                 addlogmsg(request.user.username, instance.name, msg)
                 return HttpResponseRedirect(request.get_full_path() + '#powerforce')
 
-            if 'delete' in request.POST:
+            if 'delete' in request.POST and (request.user.is_superuser or userinstace.is_delete):
                 if conn.get_status() == 1:
                     conn.force_shutdown()
                 if request.POST.get('delete_disk', ''):
@@ -330,7 +330,7 @@ def instance(request, compute_id, vname):
                     msg = _("Please shutdow down your instance and then try again")
                     error_messages.append(msg)
 
-            if 'resize' in request.POST:
+            if 'resize' in request.POST and (request.user.is_superuser or userinstace.is_change):
                 vcpu = request.POST.get('vcpu', '')
                 cur_vcpu = request.POST.get('cur_vcpu', '')
                 memory = request.POST.get('memory', '')
@@ -418,6 +418,7 @@ def instance(request, compute_id, vname):
                         addlogmsg(request.user.username, instance.name, msg)
                         return HttpResponseRedirect(request.get_full_path() + '#xmledit')
 
+            if request.user.is_superuser or userinstace.is_vnc:
                 if 'set_console_passwd' in request.POST:
                     if request.POST.get('auto_pass', ''):
                         passwd = randomPasswd()
@@ -456,6 +457,7 @@ def instance(request, compute_id, vname):
                     addlogmsg(request.user.username, instance.name, msg)
                     return HttpResponseRedirect(request.get_full_path() + '#vncsettings')
 
+            if request.user.is_superuser:
                 if 'migrate' in request.POST:
                     compute_id = request.POST.get('compute_id', '')
                     live = request.POST.get('live_migrate', False)