Detections
Analytics

1.18 WN11-00-000080

Information

Only authorized user accounts must be allowed to create or run virtual machines on Windows 11 systems.

GROUP ID: V-253271
RULE ID: SV-253271r958702

Allowing other operating systems to run on a secure system may allow users to circumvent security. For Hyper-V, preventing unauthorized users from being assigned to the Hyper-V Administrators group will prevent them from accessing or creating virtual machines on the system. The Hyper-V Hypervisor is used by virtualization-based Security features such as Credential Guard on Windows 11; however, it is not the full Hyper-V installation.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

For Hyper-V, remove any unauthorized groups or user accounts from the 'Hyper-V Administrators' group.

For hosted hypervisors other than Hyper-V, restrict access to create or run virtual machines to authorized user accounts only.

See Also

https://workbench.cisecurity.org/benchmarks/27756

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-3(4), CCI|CCI-002165, Rule-ID|SV-253271r958702_rule, STIG-ID|WN11-00-000080, Vuln-ID|V-253271

Plugin: Windows

Control ID: ed9d3bb3c3e96df034164eb5acbc407936a7aeacea6e98dbd705c6b83133c0b5