The best choice when no access to networked resources is needed out of the box. For each connecting user, a virtual account that is by default a member of the administrators group is created during an active session. As the local account has no inherent access to network resources, you might want to grant the computer account access to said resources.

It is possible to change the group memberships of the virtual account by using the parameter or the RunAsVirtualAccountGroups key in your session configuration file.