The vCenter Server Administrator role must be secured and assigned to specific users other than a Windows Administrator.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-243131	VCTR-67-000076	SV-243131r719636_rule		Medium

Description
By default, vCenter Server grants full administrative rights to the local administrator's account, which can be accessed by domain administrators. Separation of duties dictates that full vCenter Administrative rights should be granted only to those administrators who are required to have it. This privilege should not be granted to any group whose membership is not strictly controlled. Therefore, administrative rights should be removed from the local Windows server to users who are not vCenter administrators.

Description

By default, vCenter Server grants full administrative rights to the local administrator's account, which can be accessed by domain administrators. Separation of duties dictates that full vCenter Administrative rights should be granted only to those administrators who are required to have it. This privilege should not be granted to any group whose membership is not strictly controlled. Therefore, administrative rights should be removed from the local Windows server to users who are not vCenter administrators.

STIG	Date
VMware vSphere 6.7 vCenter Security Technical Implementation Guide	2021-04-16

Details

Check Text ( C-46406r719634_chk )
Note: For vCenter Server Appliance, this is not applicable. If enhanced linked mode is used then local windows authentication is not available to vCenter, this is not applicable. Under the computer management console for windows view the local administrators group and verify only vCenter administrators have access to the vCenter server. Other groups and users that are not vCenter administrators should be removed from the local administrators group such as Domain Admins. If there are any groups or users present in the local administrators group of the vCenter server, this is a finding.

Check Text ( C-46406r719634_chk )

Note: For vCenter Server Appliance, this is not applicable.

If enhanced linked mode is used then local windows authentication is not available to vCenter, this is not applicable.

Under the computer management console for windows view the local administrators group and verify only vCenter administrators have access to the vCenter server.

Other groups and users that are not vCenter administrators should be removed from the local administrators group such as Domain Admins.

If there are any groups or users present in the local administrators group of the vCenter server, this is a finding.

Fix Text (F-46363r719635_fix)
Under the computer management console for windows view the local administrators group and remove any users or groups that do not fit the criteria defined in the check content.