Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.copy.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.copy.disable If the virtual machine advanced setting isolation.tools.copy.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.copy.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.copy.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.copy.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.dnd.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dnd.disable If the virtual machine advanced setting isolation.tools.dnd.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.dnd.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.dnd.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dnd.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.setGUIOptions.enable value and verify it is set to false. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.setGUIOptions.enable If the virtual machine advanced setting isolation.tools.setGUIOptions.enable does not exist or is not set to false, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.setGUIOptions.enable value and set it to false. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.setGUIOptions.enable -Value false If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.setGUIOptions.enable | Set-AdvancedSetting -Value false
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.paste.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.paste.disable If the virtual machine advanced setting isolation.tools.paste.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.paste.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.paste.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.paste.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.diskShrink.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskShrink.disable If the virtual machine advanced setting isolation.tools.diskShrink.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.diskShrink.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.diskShrink.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskShrink.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.diskWiper.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskWiper.disable If the virtual machine advanced setting isolation.tools.diskWiper.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.diskWiper.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.diskWiper.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskWiper.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the attached hard disks and verify they are not configured as independent nonpersistent disks. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-HardDisk | Select Parent, Name, Filename, DiskType, Persistence | FT -AutoSize If the virtual machine has attached disks that are in independent nonpersistent mode, this is a finding.
The target VM must be powered off prior to changing the hard disk mode. From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the target hard disk and change the mode to persistent or uncheck Independent. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-HardDisk | Set-HardDisk -Persistence IndependentPersistent or Get-VM "VM Name" | Get-HardDisk | Set-HardDisk -Persistence Persistent
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.hgfsServerSet.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.hgfsServerSet.disable If the virtual machine advanced setting isolation.tools.hgfsServerSet.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.hgfsServerSet.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.hgfsServerSet.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.hgfsServerSet.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.autologon.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.autologon.disable If the virtual machine advanced setting isolation.tools.ghi.autologon.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.autologon.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.ghi.autologon.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.autologon.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.bios.bbs.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.bios.bbs.disable If the virtual machine advanced setting isolation.bios.bbs.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.bios.bbs.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.bios.bbs.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.bios.bbs.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.getCreds.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.getCreds.disable If the virtual machine advanced setting isolation.tools.getCreds.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.getCreds.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.getCreds.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.getCreds.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.launchmenu.change value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.launchmenu.change If the virtual machine advanced setting isolation.tools.ghi.launchmenu.change does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.launchmenu.change value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.ghi.launchmenu.change -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.launchmenu.change | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.memSchedFakeSampleStats.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.memSchedFakeSampleStats.disable If the virtual machine advanced setting isolation.tools.memSchedFakeSampleStats.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.memSchedFakeSampleStats.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.memSchedFakeSampleStats.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.memSchedFakeSampleStats.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.protocolhandler.info.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.protocolhandler.info.disable If the virtual machine advanced setting isolation.tools.ghi.protocolhandler.info.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.protocolhandler.info.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.ghi.protocolhandler.info.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.protocolhandler.info.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.ghi.host.shellAction.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.ghi.host.shellAction.disable If the virtual machine advanced setting isolation.ghi.host.shellAction.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.ghi.host.shellAction.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.ghi.host.shellAction.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.ghi.host.shellAction.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.dispTopoRequest.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dispTopoRequest.disable If the virtual machine advanced setting isolation.tools.dispTopoRequest.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.dispTopoRequest.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.dispTopoRequest.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dispTopoRequest.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.trashFolderState.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.trashFolderState.disable If the virtual machine advanced setting isolation.tools.trashFolderState.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.trashFolderState.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.trashFolderState.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.trashFolderState.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.trayicon.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.trayicon.disable If the virtual machine advanced setting isolation.tools.ghi.trayicon.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.ghi.trayicon.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.ghi.trayicon.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.ghi.trayicon.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.disable If the virtual machine advanced setting isolation.tools.unity.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unity.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unityInterlockOperation.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unityInterlockOperation.disable If the virtual machine advanced setting isolation.tools.unityInterlockOperation.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unityInterlockOperation.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unityInterlockOperation.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unityInterlockOperation.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.push.update.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.push.update.disable If the virtual machine advanced setting isolation.tools.unity.push.update.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.push.update.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unity.push.update.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.push.update.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.taskbar.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.taskbar.disable If the virtual machine advanced setting isolation.tools.unity.taskbar.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.taskbar.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unity.taskbar.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.taskbar.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unityActive.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unityActive.disable If the virtual machine advanced setting isolation.tools.unityActive.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unityActive.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unityActive.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unityActive.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.windowContents.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.windowContents.disable If the virtual machine advanced setting isolation.tools.unity.windowContents.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.unity.windowContents.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.unity.windowContents.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.unity.windowContents.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.vmxDnDVersionGet.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.vmxDnDVersionGet.disable If the virtual machine advanced setting isolation.tools.vmxDnDVersionGet.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.vmxDnDVersionGet.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.vmxDnDVersionGet.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.vmxDnDVersionGet.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.guestDnDVersionSet.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.guestDnDVersionSet.disable If the virtual machine advanced setting isolation.tools.guestDnDVersionSet.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.guestDnDVersionSet.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.guestDnDVersionSet.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.guestDnDVersionSet.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.vixMessage.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.vixMessage.disable If the virtual machine advanced setting isolation.tools.vixMessage.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.vixMessage.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.vixMessage.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.vixMessage.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the VMs hardware and verify no floppy devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM | Get-FloppyDrive | Select Parent, Name, ConnectionState If a virtual machine has a floppy drive present, this is a finding.
The VM must be powered off in order to remove a floppy drive. From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the floppy drive and click remove then OK. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-FloppyDrive | Remove-FloppyDrive
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the VMs hardware and verify no CD/DVD drives are connected. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent,Name If a virtual machine has a CD/DVD drive connected other than temporarily, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the CD/DVD drive and uncheck "Connected" and "Connect at power on" and remove any attached ISOs. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-CDDrive | Set-CDDrive -NoMedia
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the VMs hardware and verify no parallel devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "parallel"} If a virtual machine has a parallel device present, this is a finding.
The VM must be powered off in order to remove a parallel device. From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the parallel device and click remove then OK.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the VMs hardware and verify no serial devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "serial"} If a virtual machine has a serial device present, this is a finding.
The VM must be powered off in order to remove a serial device. From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the serial device and click remove then OK.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Review the VMs hardware and verify no USB devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following commands: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "usb"} Get-VM | Get-UsbDevice If a virtual machine has any USB devices or USB controllers present, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings. Select the USB controller and click remove then OK. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-USBDevice | Remove-USBDevice Note: This will not remove the USB controller just any connected devices.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the RemoteDisplay.maxConnections value and verify it is set to 1. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.maxConnections If the virtual machine advanced setting RemoteDisplay.maxConnections does not exist or is not set to 1, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the RemoteDisplay.maxConnections value and set it to 1. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name RemoteDisplay.maxConnections -Value 1 If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.maxConnections | Set-AdvancedSetting -Value 1
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the RemoteDisplay.vnc.enabled value and verify it is set to false. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.vnc.enabled If the virtual machine advanced setting RemoteDisplay.vnc.enabled does not exist or is not set to false, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the RemoteDisplay.vnc.enabled value and set it to false. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name RemoteDisplay.vnc.enabled -Value false If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.vnc.enabled | Set-AdvancedSetting -Value false
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.autoInstall.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.autoInstall.disable If the virtual machine advanced setting isolation.tools.autoInstall.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.tools.autoInstall.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.tools.autoInstall.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.autoInstall.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the tools.setinfo.sizeLimit value and verify it is set to 1048576. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.setinfo.sizeLimit If the virtual machine advanced setting tools.setinfo.sizeLimit does not exist or is not set to 1048576, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the tools.setinfo.sizeLimit value and set it to 1048576. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name tools.setinfo.sizeLimit -Value 1048576 If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.setinfo.sizeLimit | Set-AdvancedSetting -Value 1048576
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.device.connectable.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.connectable.disable If the virtual machine advanced setting isolation.device.connectable.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.device.connectable.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.device.connectable.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.connectable.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.device.edit.disable value and verify it is set to true. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.edit.disable If the virtual machine advanced setting isolation.device.edit.disable does not exist or is not set to true, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the isolation.device.edit.disable value and set it to true. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name isolation.device.edit.disable -Value true If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.edit.disable | Set-AdvancedSetting -Value true
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the tools.guestlib.enableHostInfo value and verify it is set to false. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guestlib.enableHostInfo If the virtual machine advanced setting tools.guestlib.enableHostInfo does not exist or is not set to false, this is a finding.
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Find the tools.guestlib.enableHostInfo value and set it to false. If the setting does not exist click "Add Row" to add the setting to the virtual machine. Note: The VM must be powered off to configure the advanced settings through the vSphere Client so it is recommended to configure these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: If the setting does not exist run: Get-VM "VM Name" | New-AdvancedSetting -Name tools.guestlib.enableHostInfo -Value false If the setting exists run: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guestlib.enableHostInfo | Set-AdvancedSetting -Value false
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Verify the sched.mem.pshare.salt setting does not exist. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name sched.mem.pshare.salt If the virtual machine advanced setting sched.mem.pshare.salt exists, this is a finding.
From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name sched.mem.pshare.salt | Remove-AdvancedSetting
From the vSphere Client select the Virtual Machine right click and go to Edit Settings >> VM Options Tab >> Advanced >> Configuration Parameters. Look for settings with the format ethernet*.filter*.name. Note: The VM must be powered off to view the advanced settings through the vSphere Client so it is recommended to view these settings with PowerCLI as it can be done while the VM is powered on. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name "ethernet*.filter*.name*" If the virtual machine advanced setting ethernet*.filter*.name exists and dvfilters are not in use, this is a finding. If the virtual machine advanced setting ethernet*.filter*.name exists and the value is not valid, this is a finding.
From a PowerCLI command prompt while connected to the ESXi host or vCenter server run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name ethernetX.filterY.name | Remove-AdvancedSetting Note: Change the X and Y values to match the specific setting in your environment.
Ask the SA if hardened, patched templates are used for VM creation, properly configured OS deployments, including applications both dependent and non-dependent on VM-specific configurations. If hardened, patched templates are not used for VM creation, this is a finding.
Create hardened virtual machine templates to use for OS deployments.
Remote management services, such as terminal services and SSH, must be used to interact with virtual machines. VM console access should only be granted when remote management services are unavailable or insufficient to perform necessary management tasks. Ask the SA if a VM console is used to perform VM management tasks, other than for troubleshooting VM issues. If a VM console is used to perform VM management tasks, other than for troubleshooting VM issues, this is a finding. If SSH and/or terminal management services are exclusively used to perform management tasks, this is not a finding.
Develop a policy prohibiting the use of a VM console for performing management services. This policy should include procedures for the use of SSH and Terminal Management services for VM management. Where SSH and Terminal Management services prove insufficient to troubleshoot a VM, access to the VM console may be temporarily granted.