Detections
Analytics

3.13 (L1) Host must unlock accounts after a specified timeout period

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Ensuring that user accounts on the ESXi host are automatically unlocked after a specified period contributes to a balance between security and operational usability. This mechanism reactivates idle accounts promptly while mitigating potential unauthorized access risks. It's configured through a specific parameter which, when adjusted, defines the duration of the lockout period. The parameter governing this behavior is Security.AccountUnlockTime with a recommended setting of 900 seconds.

This setting reduces the inconvenience for benign users and the overhead on administrators, while also slowing down brute force credential stuffing attacks.

Solution

To set the account lockout to 15 minutes, perform the following:

 - From the vSphere Web Client, select the host.
 - Click Configure then expand System.
 - Select Advanced System Settings then click Edit.
 - Enter Security.AccountUnlockTime in the filter.
 - Set the value for this parameter to 900.

Alternately, use the following PowerCLI command:

Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime | Set-AdvancedSetting -Value 900

Impact:

No functional impact noted. The parameter's configuration ensures a security-usability balance, although misconfiguration could either expose the system to unauthorized access or disrupt user operations.

See Also

https://workbench.cisecurity.org/benchmarks/21888

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11

Plugin: VMware

Control ID: 8a238f8dea988615e015a6da4ba650a04eabbfdf8262a5ff04415aad015cc0fa