Select any two versions of this STIG to compare the individual requirements
Select any old version/release of this STIG to view the previous requirements
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.tools.copy.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.copy.disable If the virtual machine advanced setting "isolation.tools.copy.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.tools.copy.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.tools.copy.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.copy.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.tools.dnd.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dnd.disable If the virtual machine advanced setting "isolation.tools.dnd.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.tools.dnd.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.tools.dnd.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.dnd.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.tools.paste.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.paste.disable If the virtual machine advanced setting "isolation.tools.paste.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.tools.paste.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.tools.paste.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.paste.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.tools.diskShrink.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskShrink.disable If the virtual machine advanced setting "isolation.tools.diskShrink.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.tools.diskShrink.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.tools.diskShrink.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskShrink.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.tools.diskWiper.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskWiper.disable If the virtual machine advanced setting "isolation.tools.diskWiper.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.tools.diskWiper.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.tools.diskWiper.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.tools.diskWiper.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "RemoteDisplay.maxConnections" value is set to "1". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.maxConnections If the virtual machine advanced setting "RemoteDisplay.maxConnections" does not exist or is not set to "1", this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "RemoteDisplay.maxConnections" value and set it to "1". If the setting does not exist, add the Name and Value setting at the bottom of screen. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name RemoteDisplay.maxConnections | Set-AdvancedSetting -Value 1 Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "tools.setinfo.sizeLimit" value is set to "1048576". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.setinfo.sizeLimit If the virtual machine advanced setting "tools.setinfo.sizeLimit" is not set to "1048576", this is a finding. If the virtual machine advanced setting "tools.setinfo.sizeLimit" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "tools.setinfo.sizeLimit" value and set it to "1048576". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.setinfo.sizeLimit | Set-AdvancedSetting -Value 1048576 Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "isolation.device.connectable.disable" value is set to "true". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.connectable.disable If the virtual machine advanced setting "isolation.device.connectable.disable" is not set to "true", this is a finding. If the virtual machine advanced setting "isolation.device.connectable.disable" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "isolation.device.connectable.disable" value and set it to "true". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name isolation.device.connectable.disable | Set-AdvancedSetting -Value true Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "tools.guestlib.enableHostInfo" value is set to "false". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guestlib.enableHostInfo If the virtual machine advanced setting "tools.guestlib.enableHostInfo" is not set to "false", this is a finding. If the virtual machine advanced setting "tools.guestlib.enableHostInfo" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "tools.guestlib.enableHostInfo" value and set it to "false". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guestlib.enableHostInfo | Set-AdvancedSetting -Value false Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "sched.mem.pshare.salt" setting does not exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name sched.mem.pshare.salt If the virtual machine advanced setting "sched.mem.pshare.salt" exists, this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Delete the "sched.mem.pshare.salt" setting. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name sched.mem.pshare.salt | Remove-AdvancedSetting Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the settings with the format "ethernet*.filter*.name" do not exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name "ethernet*.filter*.name*" If the virtual machine advanced setting "ethernet*.filter*.name" exists and dvfilters are not in use, this is a finding. If the virtual machine advanced setting "ethernet*.filter*.name" exists and the value is not valid, this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Look for settings with the format "ethernet*.filter*.name". Ensure only required VMs use this setting. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name ethernetX.filterY.name | Remove-AdvancedSetting Note: Change the X and Y values to match the specific setting in the organization's environment. Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options. Verify the option "Lock the guest operating system when the last remote user disconnects" is checked. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock If the virtual machine advanced setting "tools.guest.desktop.autolock" is not set to "true", this is a finding. If the virtual machine advanced setting "tools.guest.desktop.autolock" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options. Check the box next to "Lock the guest operating system when the last remote user disconnects". Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock | Set-AdvancedSetting -Value true
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings. Expand the "Video card" and verify the "Enable 3D Support" checkbox is unchecked. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name mks.enable3d If the virtual machine advanced setting "mks.enable3d" exists and is not set to "false", this is a finding. If the virtual machine advanced setting "mks.enable3d" does not exist, this is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings. Expand the "Video card" and uncheck the "Enable 3D Support" checkbox. Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name mks.enable3d | Set-AdvancedSetting -Value "false" Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Encryption. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {($_.ExtensionData.Config.MigrateEncryption -eq "disabled")} If the "Encrypted vMotion" setting does not have a value of "Opportunistic" or "Required", this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Encryption. For "Encrypted vMotion" set the value to "Opportunistic" or "Required". Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: $spec = New-Object VMware.Vim.VirtualMachineConfigSpec $spec.MigrateEncryption = New-Object VMware.Vim.VirtualMachineConfigSpecEncryptedVMotionModes $spec.MigrateEncryption = $true (Get-VM -Name <vmname>).ExtensionData.ReconfigVM($spec)
If the Virtual Machine does not have Fault Tolerance enabled, this is not applicable. For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Encryption. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {($_.ExtensionData.Config.FtEncryptionMode -ne "ftEncryptionOpportunistic") -and ($_.ExtensionData.Config.FtEncryptionMode -ne "ftEncryptionRequired")} If the "Encrypted FT" setting does not have a value of "Opportunistic" or "Required", this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Encryption. For "Encrypted FT" set the value to "Opportunistic" or "Required". Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: $spec = New-Object VMware.Vim.VirtualMachineConfigSpec $spec.FTEncryption = New-Object VMware.Vim.VMware.Vim.VirtualMachineConfigSpecEncryptedFtModes $spec.FT = ftEncryptionOpportunistic or ftEncryptionRequired (Get-VM -Name <vmname>).ExtensionData.ReconfigVM($spec)
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "log.rotateSize" value is set to "2048000". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name log.rotateSize If the virtual machine advanced setting "log.rotateSize" is not set to "2048000", this is a finding. If the virtual machine advanced setting "log.rotateSize" does NOT exist, this is NOT a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "log.rotateSize" value and set it to "2048000". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name log.rotateSize | Set-AdvancedSetting -Value 2048000 Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Verify the "log.keepOld" value is set to "10". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name log.keepOld If the virtual machine advanced setting "log.keepOld" is not set to "10", this is a finding. If the virtual machine advanced setting "log.keepOld" does NOT exist, this is NOT a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> Advanced Parameters. Find the "log.keepOld" value and set it to "10". If the setting does not exist no action is needed. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-AdvancedSetting -Name log.keepOld | Set-AdvancedSetting -Value 10 Note: The VM must be powered off to configure the advanced settings through the vSphere Client. Therefore, it is recommended to configure these settings with PowerCLI as this can be done while the VM is powered on. Settings do not take effect via either method until the virtual machine is cold started, not rebooted.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Advanced. Ensure that the checkbox next to "Enable logging" is checked. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {$_.ExtensionData.Config.Flags.EnableLogging -ne "True"} If logging is not enabled, this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> Advanced. Click the checkbox next to "Enable logging". Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: $spec = New-Object VMware.Vim.VirtualMachineConfigSpec $spec.Flags = New-Object VMware.Vim.VirtualMachineFlagInfo $spec.Flags.enableLogging = $true (Get-VM -Name <vmname>).ExtensionData.ReconfigVM($spec)
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Review the attached hard disks and verify they are not configured as independent nonpersistent disks. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-HardDisk | Select Parent, Name, Filename, DiskType, Persistence | FT -AutoSize If the virtual machine has attached disks that are in independent nonpersistent mode and are not documented, this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Select the target hard disk and change the mode to persistent or uncheck Independent. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run one of the following commands: Get-VM "VM Name" | Get-HardDisk | Set-HardDisk -Persistence IndependentPersistent or Get-VM "VM Name" | Get-HardDisk | Set-HardDisk -Persistence Persistent
Floppy drives are no longer visible through the vSphere Client and must be done via the Application Programming Interface (API) or PowerCLI. From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Get-FloppyDrive | Select Parent, Name, ConnectionState If a virtual machine has a floppy drive connected, this is a finding.
Floppy drives are no longer visible through the vSphere Client and must be done via the Application Programming Interface (API) or PowerCLI. The VM must be powered off to remove a floppy drive. From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-FloppyDrive | Remove-FloppyDrive
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Review the VMs hardware and verify no CD/DVD drives are connected. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Get-CDDrive | Where {$_.extensiondata.connectable.connected -eq $true} | Select Parent,Name If a virtual machine has a CD/DVD drive connected other than temporarily, this is a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Select the CD/DVD drive and uncheck "Connected" and "Connect at power on" and remove any attached ISOs. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-CDDrive | Set-CDDrive -NoMedia
Parallel devices are no longer visible through the vSphere Client and must be done via the Application Programming Interface (API) or PowerCLI. From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "parallel"} If a virtual machine has a parallel device present, this is a finding.
Parallel devices are no longer visible through the vSphere Client and must be done via the Application Programming Interface (API) or PowerCLI. The VM must be powered off to remove a parallel device. From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: $pport = (Get-VM -Name <vmname>).ExtensionData.Config.Hardware.Device | Where {$_.DeviceInfo.Label -match "Parallel"} $spec = New-Object VMware.Vim.VirtualMachineConfigSpec $spec.DeviceChange += New-Object VMware.Vim.VirtualDeviceConfigSpec $spec.DeviceChange[-1].device = $pport $spec.DeviceChange[-1].operation = "remove" (Get-VM -Name <vmname>).ExtensionData.ReconfigVM($spec)
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Review the VMs hardware and verify no serial devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "serial"} If a virtual machine has a serial device present, this is a finding.
The VM must be powered off to remove a serial device. For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Select the serial device, click the circled "X" to remove it, and click "OK".
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Review the VM's hardware and verify no USB devices exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: Get-VM | Where {$_.ExtensionData.Config.Hardware.Device.DeviceInfo.Label -match "usb"} Get-VM | Get-UsbDevice If a virtual machine has any USB devices or USB controllers present, this is a finding. If USB smart card readers are used to pass smart cards through the VM console to a VM, the use of a USB controller and USB devices for that purpose is not a finding.
For each virtual machine do the following: From the vSphere Client, right-click the Virtual Machine and go to "Edit Settings". Select the USB controller, click the circled "X" to remove it, and click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-USBDevice | Remove-USBDevice Note: This will not remove the USB controller, just any connected devices.
For each virtual machine do the following: From the vSphere Client, view the Summary tab. Review the PCI devices section and verify none exist. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-PassthroughDevice If the virtual machine has passthrough devices present, and the specific device returned is not approved, this is a finding.
From the vSphere Client, select the Virtual Machine, right-click and go to Edit Settings >> Virtual Hardware tab. Find the unexpected PCI device returned from the check. Hover the mouse over the device and click the circled "X" to remove the device. Click "OK". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM "VM Name" | Get-PassthroughDevice | Remove-PassthroughDevice