CF 10 dedicated instance user accounts - instance isolation

CF10 on Windows 2008R2, IIS 7.5

Trying to implement application isolation as per CF10 Lockdown guide.

I am asigning dedicated user account for each individual instance.

However, the cfadmin Administrator console will start any other instance using cfadmin's account instead of the instance account.

PLEASE let me know if there is a way to have the Adminuistrator console to strat each instance with it's onw account.

I tried using windows service as well, but because the account is not member neither of Users, and of course not Administrators group, the service will not start. Please advise