8.6.2 Disable virtual disk shrinking

Information

If Virtual disk shrinking is done repeatedly it will cause the virtual disk to become
unavailable resulting in a denial of service. You can prevent virtual disk shrinking by
disabling it.

*Rationale*

Shrinking a virtual disk reclaims unused space in it. If there is empty space in the disk, this
process reduces the amount of space the virtual disk occupies on the host drive. Normal
users and processes that is, users and processes without root or administrator
privileges within virtual machines have the capability to invoke this procedure. However,
if this is done repeatedly, the virtual disk can become unavailable while this shrinking is
being performed, effectively causing a denial of service. In most datacenter environments,
disk shrinking is not done, so you should disable this feature. Repeated disk shrinking can
make a virtual disk unavailable. This capability is available to nonadministrative users in
the guest.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.diskShrink.disable' -value $true

Impact-Inability to shrink virtual machine disks in the event that a datastore runs out of space.

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/145

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: VMware

Control ID: 4be13229ad0c74286ecdf6761349b04511ab6776c5aa1aad9a3bb5f785d07fc6