8.4.18 Ensure Unity is disabled

Information

The Unity feature should be disabled if it is not needed.

*Rationale*

Some VMX parameters don't apply on vSphere because VMware virtual machines work on
vSphere and hosted virtualization platforms such as Workstation and Fusion. The
codepaths for these features is not implementing in ESX. Explicitly disabling these features
reduces the potential for vulnerabilities because it reduces the number of ways in which a
guest can affect the host. Note that these are documented for customers that insist any
documented setting, regardless of whether it is implemented in code or not, must have a
value.

Solution

To disable the Unity feature, run the following PowerCLI command:

# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'isolation.tools.unity.disable' -value $true

See Also

https://workbench.cisecurity.org/files/2168

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|9.2

Plugin: VMware

Control ID: 5261c945e3624c6577661fb9f4aaa20cc27718077ad233b654f0fb0376c54d41