Virtual machines (VMs) must be configured to lock when the last console connection is closed.

When accessing the VM console, the guest operating system must be locked when the last console user disconnects, limiting the possibility of session hijacking. This setting only applies to Windows-based VMs with VMware tools installed.

For each virtual machine do the following:

From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options.

Verify the option "Lock the guest operating system when the last remote user disconnects" is checked.

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock

If the virtual machine advanced setting "tools.guest.desktop.autolock" is not set to "true", this is a finding.

If the virtual machine advanced setting "tools.guest.desktop.autolock" does not exist, this is not a finding.

For each virtual machine do the following:

From the vSphere Client, right-click the Virtual Machine and go to Edit Settings >> VM Options >> VMware Remote Console Options.

Check the box next to "Lock the guest operating system when the last remote user disconnects". Click "OK".

or

From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command:

Get-VM "VM Name" | Get-AdvancedSetting -Name tools.guest.desktop.autolock | Set-AdvancedSetting -Value true