Detections
Analytics

1.67 VCSA-80-000305

Information

The vCenter Server must disable accounts used for Integrated Windows Authentication (IWA).

GROUP ID: V-265979RULE ID: SV-265979r1003616

If not used for their intended purpose, default accounts must be disabled. vCenter ships with several default accounts, two of which are specific to IWA and SASL/Kerberos authentication. If other methods of authentication are used, these accounts are not needed and must be disabled.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Users.

Select the "K/M" or "krbtgt/VSPHERE.LOCAL" and click "More" then select "Disable".

Click "Ok" to disable the user account.

See Also

https://workbench.cisecurity.org/benchmarks/23621

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-265979r1003616_rule, STIG-ID|VCSA-80-000305, Vuln-ID|V-265979

Plugin: VMware

Control ID: 9e749259e4d310ba56da5aa70241a1b8b5aff1802581138cee27b1bddf1466e8