The operating system must automatically disable inactive accounts after an organization-defined time period.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-OS-000003-ESXI5-PNF	SRG-OS-000003-ESXI5-PNF	SRG-OS-000003-ESXI5-PNF_rule		Medium

Description
Users are often the first line of defense within an application. Active users take notice of system and data conditions and are usually the first to notify systems administrators when they notice a system or application related anomaly pertaining to their own account. Inactive user accounts pose a risk to systems and applications. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. There is a risk that inactive accounts can potentially obtain and maintain undetected access to an application. The operating system must track periods of user inactivity and disable the accounts after an organization-defined period of inactivity. Applicable, but permanent not-a-finding - There is only 1 local account on ESXi-v5 (root), which must never be disabled. All other accounts (excepting vpxuser which is automated by vCenter) are Active Directory. The root account login is locked in Lockdown Mode (a requirement).

Description

Users are often the first line of defense within an application. Active users take notice of system and data conditions and are usually the first to notify systems administrators when they notice a system or application related anomaly pertaining to their own account. Inactive user accounts pose a risk to systems and applications. Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. There is a risk that inactive accounts can potentially obtain and maintain undetected access to an application. The operating system must track periods of user inactivity and disable the accounts after an organization-defined period of inactivity. Applicable, but permanent not-a-finding - There is only 1 local account on ESXi-v5 (root), which must never be disabled. All other accounts (excepting vpxuser which is automated by vCenter) are Active Directory. The root account login is locked in Lockdown Mode (a requirement).

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-SRG-OS-000003-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-SRG-OS-000003-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.