4.3 Ensure Active Directory is used for local user authentication - Enabled = 'true'

Information

ESXi can be configured to use a directory service such as Active Directory to manage users
and groups. It is recommended that a directory service be used.

Note: If the AD group "ESX Admins" (default) is created, all users and groups that are
members of this group will have full administrative access to all ESXi hosts in the domain.

*Rationale*

Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and
maintain multiple local user accounts. Using AD for user authentication simplifies the ESXi
host configuration, ensures password complexity and reuse policies are enforced and
reduces the risk of security breaches and unauthorized access.

Solution

To use AD for local user authentication, perform the following from the vSphere Web Client:

1. Select the host and go to 'Manage' -> 'Settings' -> 'System' -> 'Authentication
Services'.
2. Click the 'Join Domain' button.
3. Provide the domain name along with the user credentials for an AD user that has the
rights to join computers to the domain.
4. Click 'OK'.

Alternately, run the following PowerCLI command:

# Join the ESXI Host to the Domain
Get-VMHost HOST1 | Get-VMHostAuthentication | Set-VMHostAuthentication -
Domain domain.local -User Administrator -Password Passw0rd -JoinDomain

Notes:
1. Host Profiles can be used to automate adding hosts to an AD domain.
2. Consider using the vSphere Authentication proxy to avoid transmitting AD
credentials over the network.

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: IDENTIFICATION AND AUTHENTICATION

References: 800-53|IA-2, CSCv7|16.2

Plugin: VMware

Control ID: 0ad135ae0780dd8c1063c2f8a036e999f74e8daec789ffd0ed82025754a2e236