← Back to VMware vSphere 8.0 vCenter Security Technical Implementation Guide

V-265979

CAT II (Medium)

The vCenter Server must disable accounts used for Integrated Windows Authentication (IWA).

Rule ID

SV-265979r1003616_rule

STIG

VMware vSphere 8.0 vCenter Security Technical Implementation Guide

Version

V2R3

CCIs

CCI-000366

Discussion

If not used for their intended purpose, default accounts must be disabled. vCenter ships with several default accounts, two of which are specific to IWA and SASL/Kerberos authentication. If other methods of authentication are used, these accounts are not needed and must be disabled.

Check Content

If IWA is used for vCenter authentication, this is not applicable.

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Users.

Change the domain to "vsphere.local" and review the "K/M" and "krbtgt/VSPHERE.LOCAL" accounts.

If the "K/M" and "krbtgt/VSPHERE.LOCAL" accounts are not disabled, this is a finding.

Fix Text

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Users.

Select the "K/M" or "krbtgt/VSPHERE.LOCAL" and click "More" then select "Disable".

Click "Ok" to disable the user account.