8.4.5 Disable Autologon

Information

Disable unneeded autologon to reduce the potential for vulnerabilities.

*Rationale*

Because VMware virtual machines are designed to work on both vSphere as well as hosted
virtualization platforms such as Workstation and Fusion, there are some VMX parameters
that don't apply when running on vSphere. Although the functionality governed by these
parameters is not exposed on ESX, explicitly disabling them will reduce the potential for
vulnerabilities. Disabling these features reduces the number of vectors through which a
guest can attempt to influence the host, and thus may help prevent successful exploits.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.ghi.autologon.disable' -value $true


Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/902

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-14a.

Plugin: VMware

Control ID: 1b85591db749bd2eae3f0caaa0145f2345164e31c4273f3a56d579495cab07d4