STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host must verify the exception users list for lockdown mode.

DISA Rule

SV-256377r959010_rule

Vulnerability Number

V-256377

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-70-000003

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Under "Lockdown Mode", click "Edit" and remove unnecessary users from the Exception Users list.

Check Contents

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Under "Lockdown Mode", review the Exception Users list.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception Users list contains accounts that do not require special permissions, this is a finding.

Note: The Exception Users list is empty by default and should remain that way except under site-specific circumstances.

Vulnerability Number

V-256377

Documentable

False

Rule Version

ESXI-70-000003

Severity Override Guidance

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Under "Lockdown Mode", review the Exception Users list.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception Users list contains accounts that do not require special permissions, this is a finding.

Note: The Exception Users list is empty by default and should remain that way except under site-specific circumstances.

Check Content Reference

M

Target Key

5518