Virtual machines must remove unnecessary AHCI devices

MediumLevel 1Manual reviewvmware

Description

Removing unnecessary devices from virtual machines minimizes the attack surface and reduces potential pathways for data exfiltration or unauthorized data capture. This practice aligns with the principle of least functionality, ensuring that VMs have only the essential components required to perform their designated functions. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Inspect VM hardware for unnecessary SATA/AHCI controllers. With PowerCLI/Get-View, review virtual devices and identify VirtualAHCIController devices that do not back a required virtual disk or CD/DVD device.

How it is fixed

Fix method: Guidance or infrastructure patch

To remediate this recommendation, power off the VM if required and remove unused AHCI/SATA controllers only after removing or moving dependent devices. Do not remove a controller that is actively backing a required virtual disk.

Properties

Operating systems: Any
Tags: vmwareesxivirtual-machine
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.11 Virtual machines must remove unnecessary AHCI devices