8.4.7 Ensure Unity Window Contents is disabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

The Unity Window Contents feature should be disabled if it is not needed.

Rationale:

Some VMX parameters don't apply on vSphere because VMware virtual machines work on vSphere and hosted virtualization platforms such as Workstation and Fusion. The code paths for these features are not implemented in ESXi. Explicitly disabling these features, such as the Unity Window Contents feature, reduces the potential for vulnerabilities because it reduces the number of ways in which a guest can affect the host. Note that these are referenced for organizations that insist any documented setting, regardless of whether it is implemented in code or not, must have a value.

Impact:

Some automated tools and processes may cease to function.

Solution

To disable the Unity Window Contents feature, run the following PowerCLI command:

# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.unity.windowContents.disable' -value $True

See Also

https://workbench.cisecurity.org/files/3511