Well, it's a lot more complicated to do all those things. Just give the user a "Standard account". They can't install apps, they can't restart server. That's all and they can't access harmful server settings. That's all. So, that option is ideal for RDP buyers.