VCWN-65-000001 - The vCenter Server for Windows must prohibit password reuse for a minimum of five generations.

800-53|IA-5(1)(e)

CAT|II

CCI|CCI-000200

Rule-ID|SV-216825r879602_rule

STIG-ID|VCWN-65-000001

STIG-Legacy|SV-104545

STIG-Legacy|V-94715

Vuln-ID|V-216825

VCWN-65-000002 - The vCenter Server for Windows must not automatically refresh client sessions.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-216826r879622_rule

STIG-ID|VCWN-65-000002

STIG-Legacy|SV-104547

STIG-Legacy|V-94717

Vuln-ID|V-216826

VCWN-65-000003 - The vCenter Server for Windows must enforce a 60-day maximum password lifetime restriction.

800-53|IA-5(1)(d)

CCI|CCI-000199

Rule-ID|SV-216827r879611_rule

STIG-ID|VCWN-65-000003

STIG-Legacy|SV-104551

STIG-Legacy|V-94721

Vuln-ID|V-216827

VCWN-65-000004 - The vCenter Server for Windows must terminate management sessions after 10 minutes of inactivity.

Rule-ID|SV-216828r879622_rule

STIG-ID|VCWN-65-000004

STIG-Legacy|SV-104553

STIG-Legacy|V-94723

Vuln-ID|V-216828

VCWN-65-000005 - The vCenter Server for Windows users must have the correct roles assigned.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-216829r879631_rule

STIG-ID|VCWN-65-000005

STIG-Legacy|SV-104555

STIG-Legacy|V-94725

Vuln-ID|V-216829

VCWN-65-000007 - The vCenter Server for Windows must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of Denial of Service (DoS) attacks by enabling Network I/O Control (NIOC).

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-216830r879887_rule

STIG-ID|VCWN-65-000007

STIG-Legacy|SV-104557

STIG-Legacy|V-94727

Vuln-ID|V-216830

VCWN-65-000008 - The vCenter Server for Windows must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.

800-53|AU-5a.

CAT|III

CCI|CCI-000139

Rule-ID|SV-216831r879570_rule

STIG-ID|VCWN-65-000008

STIG-Legacy|SV-104559

STIG-Legacy|V-94729

Vuln-ID|V-216831

VCWN-65-000009 - The vCenter Server for Windows must use Active Directory authentication.

800-53|IA-2(5)

CCI|CCI-000770

Rule-ID|SV-216832r879594_rule

STIG-ID|VCWN-65-000009

STIG-Legacy|SV-104561

STIG-Legacy|V-94731

Vuln-ID|V-216832

VCWN-65-000010 - The vCenter Server for Windows must limit the use of the built-in SSO administrative account.

Rule-ID|SV-216833r879594_rule

STIG-ID|VCWN-65-000010

STIG-Legacy|SV-104563

STIG-Legacy|V-94733

Vuln-ID|V-216833

VCWN-65-000012 - The vCenter Server for Windows must disable the distributed virtual switch health check.

Rule-ID|SV-216834r879887_rule

STIG-ID|VCWN-65-000012

STIG-Legacy|SV-104565

STIG-Legacy|V-94735

Vuln-ID|V-216834

VCWN-65-000013 - The vCenter Server for Windows must set the distributed port group Forged Transmits policy to reject.

Rule-ID|SV-216835r879887_rule

STIG-ID|VCWN-65-000013

STIG-Legacy|SV-104567

STIG-Legacy|V-94737

Vuln-ID|V-216835

VCWN-65-000014 - The vCenter Server for Windows must set the distributed port group MAC Address Change policy to reject.

CAT|I

Rule-ID|SV-216836r879887_rule

STIG-ID|VCWN-65-000014

STIG-Legacy|SV-104569

STIG-Legacy|V-94739

Vuln-ID|V-216836

VCWN-65-000015 - The vCenter Server for Windows must set the distributed port group Promiscuous Mode policy to reject.

Rule-ID|SV-216837r879887_rule

STIG-ID|VCWN-65-000015

STIG-Legacy|SV-104571

STIG-Legacy|V-94741

Vuln-ID|V-216837

VCWN-65-000016 - The vCenter Server for Windows must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-216838r879887_rule

STIG-ID|VCWN-65-000016

STIG-Legacy|SV-104573

STIG-Legacy|V-94743

Vuln-ID|V-216838

VCWN-65-000017 - The vCenter Server for Windows must not override port group settings at the port level on distributed switches.

Rule-ID|SV-216839r879887_rule

STIG-ID|VCWN-65-000017

STIG-Legacy|SV-104575

STIG-Legacy|V-94745

Vuln-ID|V-216839

VCWN-65-000018 - The vCenter Server for Windows must configure all port groups to a value other than that of the native VLAN.

Rule-ID|SV-216840r879887_rule

STIG-ID|VCWN-65-000018

STIG-Legacy|SV-104577

STIG-Legacy|V-94747

Vuln-ID|V-216840

VCWN-65-000019 - The vCenter Server for Windows must configure all port groups to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.

Rule-ID|SV-216841r879887_rule

STIG-ID|VCWN-65-000019

STIG-Legacy|SV-104579

STIG-Legacy|V-94749

Vuln-ID|V-216841

VCWN-65-000020 - The vCenter Server for Windows must not configure all port groups to VLAN values reserved by upstream physical switches.

Rule-ID|SV-216842r879887_rule

STIG-ID|VCWN-65-000020

STIG-Legacy|SV-104581

STIG-Legacy|V-94751

Vuln-ID|V-216842

VCWN-65-000021 - The vCenter Server for Windows must enable SSL for Network File Copy (NFC).

Rule-ID|SV-216843r879887_rule

STIG-ID|VCWN-65-000021

STIG-Legacy|SV-104583

STIG-Legacy|V-94753

Vuln-ID|V-216843

VCWN-65-000022 - The vCenter Server for Windows services must be ran using a service account instead of a built-in Windows account.

Rule-ID|SV-216844r879887_rule

STIG-ID|VCWN-65-000022

STIG-Legacy|SV-104585

STIG-Legacy|V-94755

Vuln-ID|V-216844

VCWN-65-000023 - The vCenter Server for Windows must configure the vpxuser auto-password to be changed every 30 days.

Rule-ID|SV-216845r879887_rule

STIG-ID|VCWN-65-000023

STIG-Legacy|SV-104587

STIG-Legacy|V-94757

Vuln-ID|V-216845

VCWN-65-000024 - The vCenter Server for Windows must configure the vpxuser password meets length policy.

Rule-ID|SV-216846r879887_rule

STIG-ID|VCWN-65-000024

STIG-Legacy|SV-104589

STIG-Legacy|V-94759

Vuln-ID|V-216846

VCWN-65-000025 - The vCenter Server for Windows must disable the managed object browser at all times, when not required for the purpose of troubleshooting or maintenance of managed objects.

Rule-ID|SV-216847r879887_rule

STIG-ID|VCWN-65-000025

STIG-Legacy|SV-104591

STIG-Legacy|V-94761

Vuln-ID|V-216847

VCWN-65-000026 - The vCenter Server for Windows must check the privilege re-assignment after restarts.

Rule-ID|SV-216848r879887_rule

STIG-ID|VCWN-65-000026

STIG-Legacy|SV-104675

STIG-Legacy|V-94845

Vuln-ID|V-216848

VCWN-65-000027 - The vCenter Server for Windows must minimize access to the vCenter server.

Rule-ID|SV-216849r879887_rule

STIG-ID|VCWN-65-000027

STIG-Legacy|SV-104593

STIG-Legacy|V-94763

Vuln-ID|V-216849

VCWN-65-000028 - The vCenter Server for Windows Administrators must clean up log files after failed installations.

Rule-ID|SV-216850r879887_rule

STIG-ID|VCWN-65-000028

STIG-Legacy|SV-104595

STIG-Legacy|V-94765

Vuln-ID|V-216850

VCWN-65-000029 - The vCenter Server for Windows must enable all tasks to be shown to Administrators in the Web Client.

Rule-ID|SV-216851r879887_rule

STIG-ID|VCWN-65-000029

STIG-Legacy|SV-104597

STIG-Legacy|V-94767

Vuln-ID|V-216851

VCWN-65-000030 - The vCenter Server for Windows Administrator role must be secured and assigned to specific users other than a Windows Administrator.

Rule-ID|SV-216852r879887_rule

STIG-ID|VCWN-65-000030

STIG-Legacy|SV-104599

STIG-Legacy|V-94769

Vuln-ID|V-216852

VCWN-65-000031 - The vCenter Server for Windows must restrict the connectivity between Update Manager and public patch repositories by use of a separate Update Manager Download Server.

Rule-ID|SV-216853r879887_rule

STIG-ID|VCWN-65-000031

STIG-Legacy|SV-104601

STIG-Legacy|V-94771

Vuln-ID|V-216853

VCWN-65-000032 - The vCenter Server for Windows must use a least-privileges assignment for the Update Manager database user.

Rule-ID|SV-216854r879887_rule

STIG-ID|VCWN-65-000032

STIG-Legacy|SV-104603

STIG-Legacy|V-94773

Vuln-ID|V-216854

VCWN-65-000033 - The vCenter Server for Windows must use a least-privileges assignment for the vCenter Server database user.

Rule-ID|SV-216855r879887_rule

STIG-ID|VCWN-65-000033

STIG-Legacy|SV-104605

Detections

Analytics

DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous


Revision 1.2 Feb 13, 2026 Miscellaneous Metadata updated. References updated.
Revision 1.1 Jun 17, 2024 Miscellaneous Metadata updated.

Detections

Analytics

DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3 Download File

Audit Details

File Details

Audit Changelog

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

DISA VMware vSphere 6.5 vCenter Server for Windows STIG v2r3