5.8 Set DCUI.Access to allow trusted users to override lockdown mode

Information

Create a list of highly trusted users that would be able to override lockdown mode and
access the DCUI in the event a host became isolated.

*Rationale*

Lockdown disables direct host access requiring admins manage hosts from vCenter.
However, if a host becomes isolated from vCenter the admin would become locked out and
would be unable to manage the host. To avoid potentially becoming locked out of an ESXi
hosts that is running in locked down mode set the DCUI.Access to a list of highly trusted
users that are allowed to override the lockdown mode and access the DCUI.

Solution

To implement the recommended configuration state, run the following ESXi shell
command-vim-cmd hostsvc/advopt/update DCUI.Access string [USERS]

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/902

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(4), CSCv6|5.1

Plugin: VMware

Control ID: af7f51c6dca76ed39573c5040a53c3273942b4919ddb6f4f75e1f296c3779200