VCWN-06-000022 - The vCenter Server services must be ran using a service account instead of a built-in Windows account.

Information

You can use the Microsoft Windows built-in system account or a domain user account to run vCenter Server. The Microsoft Windows built-in system account has more permissions and rights on the server than the vCenter Server system requires, which can contribute to security problems. With a domain user account, you can enable Windows authentication for SQL Server; it also allows more granular security and logging. The installing account only needs to be a member of the Administrators group, and have permission to act as part of the operating system and log on as a service. If you are using SQL Server for the vCenter database, you must configure the SQL Server database to allow the domain account access to SQL Server.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

For each of the following services open the services console on the vCenter server and right click and select properties on the service. Go to the Log On tab and configure the service to run as a service account and restart the service.

VMware Content Library Service
VMware Inventory Service
VMware Performance Charts
VMware VirtualCenter Server

See Also

http://iasecontent.disa.mil/stigs/zip/U_VMware_vSphere_6-0_vCenter_Server_for_Windows_V1R4_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-63981, Rule-ID|SV-78471r1_rule, STIG-ID|VCWN-06-000022, Vuln-ID|V-63981

Plugin: VMware

Control ID: 2e138ad5c72e558e5412c934826217579d4c3c8b8ff3bfb9353f0e59b0bf2f9c