VCWN-65-000001 - The vCenter Server for Windows must prohibit password reuse for a minimum of five generations.

800-53|IA-5(1)(e)

CAT|II

CCI|CCI-000200

Rule-ID|SV-216825r879602_rule

STIG-ID|VCWN-65-000001

STIG-Legacy|SV-104545

STIG-Legacy|V-94715

Vuln-ID|V-216825

VCWN-65-000002 - The vCenter Server for Windows must not automatically refresh client sessions.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-216826r879622_rule

STIG-ID|VCWN-65-000002

STIG-Legacy|SV-104547

STIG-Legacy|V-94717

Vuln-ID|V-216826

VCWN-65-000003 - The vCenter Server for Windows must enforce a 60-day maximum password lifetime restriction.

800-53|IA-5(1)(d)

CCI|CCI-000199

Rule-ID|SV-216827r879611_rule

STIG-ID|VCWN-65-000003

STIG-Legacy|SV-104551

STIG-Legacy|V-94721

Vuln-ID|V-216827

VCWN-65-000004 - The vCenter Server for Windows must terminate management sessions after 10 minutes of inactivity.

Rule-ID|SV-216828r879622_rule

STIG-ID|VCWN-65-000004

STIG-Legacy|SV-104553

STIG-Legacy|V-94723

Vuln-ID|V-216828

VCWN-65-000005 - The vCenter Server for Windows users must have the correct roles assigned.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-216829r879631_rule

STIG-ID|VCWN-65-000005

STIG-Legacy|SV-104555

STIG-Legacy|V-94725

Vuln-ID|V-216829

VCWN-65-000007 - The vCenter Server for Windows must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of Denial of Service (DoS) attacks by enabling Network I/O Control (NIOC).

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-216830r879887_rule

STIG-ID|VCWN-65-000007

STIG-Legacy|SV-104557

STIG-Legacy|V-94727

Vuln-ID|V-216830

VCWN-65-000008 - The vCenter Server for Windows must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.

800-53|AU-5a.

CAT|III

CCI|CCI-000139

Rule-ID|SV-216831r879570_rule

STIG-ID|VCWN-65-000008

STIG-Legacy|SV-104559

STIG-Legacy|V-94729

Vuln-ID|V-216831

VCWN-65-000009 - The vCenter Server for Windows must use Active Directory authentication.

800-53|IA-2(5)

CCI|CCI-000770

Rule-ID|SV-216832r879594_rule

STIG-ID|VCWN-65-000009

STIG-Legacy|SV-104561

STIG-Legacy|V-94731

Vuln-ID|V-216832

VCWN-65-000010 - The vCenter Server for Windows must limit the use of the built-in SSO administrative account.

Rule-ID|SV-216833r879594_rule

STIG-ID|VCWN-65-000010

STIG-Legacy|SV-104563

STIG-Legacy|V-94733

Vuln-ID|V-216833

VCWN-65-000012 - The vCenter Server for Windows must disable the distributed virtual switch health check.

Rule-ID|SV-216834r879887_rule

STIG-ID|VCWN-65-000012

STIG-Legacy|SV-104565

STIG-Legacy|V-94735

Vuln-ID|V-216834

VCWN-65-000013 - The vCenter Server for Windows must set the distributed port group Forged Transmits policy to reject.

Rule-ID|SV-216835r879887_rule

STIG-ID|VCWN-65-000013

STIG-Legacy|SV-104567

STIG-Legacy|V-94737

Vuln-ID|V-216835

VCWN-65-000014 - The vCenter Server for Windows must set the distributed port group MAC Address Change policy to reject.

CAT|I

Rule-ID|SV-216836r879887_rule

STIG-ID|VCWN-65-000014

STIG-Legacy|SV-104569

STIG-Legacy|V-94739

Vuln-ID|V-216836

VCWN-65-000015 - The vCenter Server for Windows must set the distributed port group Promiscuous Mode policy to reject.

Rule-ID|SV-216837r879887_rule

STIG-ID|VCWN-65-000015

STIG-Legacy|SV-104571

STIG-Legacy|V-94741

Vuln-ID|V-216837

VCWN-65-000016 - The vCenter Server for Windows must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-216838r879887_rule

STIG-ID|VCWN-65-000016

STIG-Legacy|SV-104573

STIG-Legacy|V-94743

Vuln-ID|V-216838

VCWN-65-000017 - The vCenter Server for Windows must not override port group settings at the port level on distributed switches.

Rule-ID|SV-216839r879887_rule

STIG-ID|VCWN-65-000017

STIG-Legacy|SV-104575

STIG-Legacy|V-94745

Vuln-ID|V-216839

VCWN-65-000018 - The vCenter Server for Windows must configure all port groups to a value other than that of the native VLAN.

Rule-ID|SV-216840r879887_rule

STIG-ID|VCWN-65-000018

STIG-Legacy|SV-104577

STIG-Legacy|V-94747

Vuln-ID|V-216840

VCWN-65-000019 - The vCenter Server for Windows must configure all port groups to VLAN 4095 unless Virtual Guest Tagging (VGT) is required.

Rule-ID|SV-216841r879887_rule

STIG-ID|VCWN-65-000019

STIG-Legacy|SV-104579

STIG-Legacy|V-94749

Vuln-ID|V-216841

VCWN-65-000020 - The vCenter Server for Windows must not configure all port groups to VLAN values reserved by upstream physical switches.

Rule-ID|SV-216842r879887_rule

STIG-ID|VCWN-65-000020

STIG-Legacy|SV-104581

STIG-Legacy|V-94751

Vuln-ID|V-216842

VCWN-65-000021 - The vCenter Server for Windows must enable SSL for Network File Copy (NFC).

Rule-ID|SV-216843r879887_rule

STIG-ID|VCWN-65-000021

STIG-Legacy|SV-104583

STIG-Legacy|V-94753

Vuln-ID|V-216843

VCWN-65-000022 - The vCenter Server for Windows services must be ran using a service account instead of a built-in Windows account.

Rule-ID|SV-216844r879887_rule

STIG-ID|VCWN-65-000022

STIG-Legacy|SV-104585

STIG-Legacy|V-94755

Vuln-ID|V-216844

VCWN-65-000023 - The vCenter Server for Windows must configure the vpxuser auto-password to be changed every 30 days.

Rule-ID|SV-216845r879887_rule

STIG-ID|VCWN-65-000023

STIG-Legacy|SV-104587

STIG-Legacy|V-94757

Vuln-ID|V-216845

VCWN-65-000024 - The vCenter Server for Windows must configure the vpxuser password meets length policy.

Rule-ID|SV-216846r879887_rule

STIG-ID|VCWN-65-000024

STIG-Legacy|SV-104589

STIG-Legacy|V-94759

Vuln-ID|V-216846

VCWN-65-000025 - The vCenter Server for Windows must disable the managed object browser at all times, when not required for the purpose of troubleshooting or maintenance of managed objects.

Rule-ID|SV-216847r879887_rule

STIG-ID|VCWN-65-000025

STIG-Legacy|SV-104591

STIG-Legacy|V-94761

Vuln-ID|V-216847

VCWN-65-000026 - The vCenter Server for Windows must check the privilege re-assignment after restarts.

Rule-ID|SV-216848r879887_rule

STIG-ID|VCWN-65-000026

STIG-Legacy|SV-104675

STIG-Legacy|V-94845

Vuln-ID|V-216848

VCWN-65-000027 - The vCenter Server for Windows must minimize access to the vCenter server.

Rule-ID|SV-216849r879887_rule

STIG-ID|VCWN-65-000027

STIG-Legacy|SV-104593

STIG-Legacy|V-94763

Vuln-ID|V-216849

VCWN-65-000028 - The vCenter Server for Windows Administrators must clean up log files after failed installations.

Rule-ID|SV-216850r879887_rule

STIG-ID|VCWN-65-000028

STIG-Legacy|SV-104595

STIG-Legacy|V-94765

Vuln-ID|V-216850

VCWN-65-000029 - The vCenter Server for Windows must enable all tasks to be shown to Administrators in the Web Client.

Rule-ID|SV-216851r879887_rule

STIG-ID|VCWN-65-000029

STIG-Legacy|SV-104597

STIG-Legacy|V-94767

Vuln-ID|V-216851

VCWN-65-000030 - The vCenter Server for Windows Administrator role must be secured and assigned to specific users other than a Windows Administrator.

Rule-ID|SV-216852r879887_rule

STIG-ID|VCWN-65-000030

STIG-Legacy|SV-104599

STIG-Legacy|V-94769

Vuln-ID|V-216852

VCWN-65-000031 - The vCenter Server for Windows must restrict the connectivity between Update Manager and public patch repositories by use of a separate Update Manager Download Server.

Rule-ID|SV-216853r879887_rule

STIG-ID|VCWN-65-000031

STIG-Legacy|SV-104601

STIG-Legacy|V-94771

Vuln-ID|V-216853

VCWN-65-000032 - The vCenter Server for Windows must use a least-privileges assignment for the Update Manager database user.

Rule-ID|SV-216854r879887_rule

STIG-ID|VCWN-65-000032

STIG-Legacy|SV-104603

STIG-Legacy|V-94773

Vuln-ID|V-216854

VCWN-65-000033 - The vCenter Server for Windows must use a least-privileges assignment for the vCenter Server database user.

Rule-ID|SV-216855r879887_rule

STIG-ID|VCWN-65-000033

STIG-Legacy|SV-104605

Detections

Analytics

DISA STIG VMware vSphere vCenter 6.5 v2r3

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous