allow user/group assign while VM is running