7.21 (L1) Virtual machines must deactivate virtual disk wiping operations

Information

Wiping a virtual disk reclaims all unused space in it. If there is empty space in the disk, this process reduces the amount of space the virtual disk occupies on the host drive. If virtual disk wiping is done repeatedly, it can cause the virtual disk to become unavailable while wiping occurs. In most datacenter environments, disk wiping is not needed, but normal users and processes--without administrative privileges--can issue disk wipes unless the feature is disabled.

Deactivating virtual disk wiping operations contributes to maintaining disk availability, which is vital for continuous system operations.

Solution

To set this configuration utilize the vSphere interface as follows:

- Select the VM then select Actions followed by Edit Settings
- Click on the VM Options tab then expand Advanced
- Click on EDIT CONFIGURATION
- Click on ADD CONFIGURATION PARAMS then input isolation.tools.diskWiper.disable with a value of TRUE
- Click OK then OK again.

To disable virtual disk wiping, run the following PowerCLI command:

# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name "isolation.tools.diskWiper.disable" -value $true

Impact:

There isn't a functional impact noted

See Also

https://workbench.cisecurity.org/benchmarks/15784

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION

References: 800-53|CM-1, 800-53|CM-2, 800-53|CM-6, 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-9, 800-53|SA-3, 800-53|SA-8, 800-53|SA-10, CSCv7|9.1

Plugin: VMware

Control ID: cb7e459f4d62d598209f4310b2fbe2284ddd14860f714615e6963f8ac957ec0a