← Back to VMware vSphere 8.0 Virtual Machine Security Technical Implementation Guide

V-258714

CAT II (Medium)

Virtual machines (VMs) must be configured to lock when the last console connection is closed.

Rule ID

SV-258714r933203_rule

STIG

VMware vSphere 8.0 Virtual Machine Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

When accessing the VM console, the guest operating system must be locked when the last console user disconnects, limiting the possibility of session hijacking. This setting only applies to Windows-based VMs with VMware tools installed.

Check Content

For each virtual machine do the following:

From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options.

Verify the option "Lock the guest operating system when the last remote user disconnects" is checked.

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock

If the virtual machine advanced setting "tools.guest.desktop.autolock" is not set to "true", this is a finding.

If the virtual machine advanced setting "tools.guest.desktop.autolock" does not exist, this is not a finding.

Fix Text

For each virtual machine do the following:

From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options.

Check the box next to "Lock the guest operating system when the last remote user disconnects". Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock | Set-AdvancedSetting -Value true