| A comprehensive account management process that includes automation helps to ensure the accounts designated as requiring attention are consistently and promptly addressed. Examples include, but are not limited to using automation to take action on multiple accounts designated as inactive, suspended or terminated, or by disabling accounts located in non-centralized account stores, such as, multiple servers. Enterprise environments make user account management challenging and complex. A user management process requiring administrators to manually address account management functions adds risk of potential oversight. Applicable, but permanent not-a-finding - There is only 1 local account on ESXi-v5 (root), which must never be disabled. All other accounts (excepting vpxuser which is automated by vCenter) are Active Directory. The root account login is locked in Lockdown Mode (a requirement). |
