Detections
Analytics

1.12 VMCH-80-000201

Information

Virtual machines (VMs) must be configured to lock when the last console connection is closed.

GROUP ID: V-258714RULE ID: SV-258714r959010

When accessing the VM console, the guest operating system must be locked when the last console user disconnects, limiting the possibility of session hijacking. This setting only applies to Windows-based VMs with VMware tools installed.

Solution

For each virtual machine do the following:

From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options.

Check the box next to "Lock the guest operating system when the last remote user disconnects". Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock | Set-AdvancedSetting -Value true

See Also

https://workbench.cisecurity.org/benchmarks/23620

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258714r959010_rule, STIG-ID|VMCH-80-000201, Vuln-ID|V-258714

Plugin: VMware

Control ID: 935e88e88c5104a943140a779df258301af51c03a86db9d87644c51d1f66f436