8.4.17 Disable Guest Host Interaction Tray Icon

Information

Disable unexposed Guest Host Interaction Tray Icon feature.

*Rationale*

Because VMware virtual machines are designed to work on both vSphere as well as hosted
virtualization platforms such as Workstation and Fusion, there are some VMX parameters
that don't apply when running on vSphere. Although the functionality governed by these
parameters is not exposed on ESX, explicitly disabling them will reduce the potential for
vulnerabilities. Disabling these features reduces the number of vectors through which a
guest can attempt to influence the host, and thus may help prevent successful exploits.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-
# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.ghi.trayicon.disable' -value $true

Impact-Some automated tools and process may cease to function.

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/902

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: VMware

Control ID: 4b633b6fd7078b78cdef4aaf44e2011004fad89431084c7f2b2a5254527f9766