← Back to VMware vSphere 7.0 vCenter Security Technical Implementation Guide

V-256371

CAT II (Medium)

The vCenter Server must limit membership to the "TrustedAdmins" Single Sign-On (SSO) group.

Rule ID

SV-256371r885724_rule

STIG

VMware vSphere 7.0 vCenter Security Technical Implementation Guide

Version

V1R3

CCIs

CCI-000366

Discussion

The vSphere "TrustedAdmins" group grants additional rights to administer the vSphere Trust Authority feature. To force accountability and nonrepudiation, the SSO group "TrustedAdmins" must be severely restricted.

Check Content

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.

Click the next page arrow until the "TrustedAdmins" group appears.

Click "TrustedAdmins".

Review the members of the group and verify only authorized accounts are present.

Note: These accounts act as root on the Photon operating system and have the ability to severely damage vCenter, inadvertently or otherwise.

If any accounts are present as members of "TrustedAdmins" that are not authorized, this is a finding.

Fix Text

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.

Click the next page arrow until the "TrustedAdmins" group appears.

Click "TrustedAdmins".

Click the three vertical dots next to the name of each unauthorized account.

Select "Remove Member".