VMware Tools should configure automatic upgrades as appropriate for the environment

MediumLevel 1Manual reviewvmware

Description

Automatic upgrades of VMware Tools can be managed via vSphere, ensuring VMware Tools versions remain current. This functionality is advisable unless alternative management and update mechanisms are in place. It is recommended to have automatic updates enabled to minimize administrative overhead and maintain up-to- date features and security patches. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

Inside each guest OS: Review each VM's VMware Tools upgrade policy in vSphere (Edit Settings > VM Options > VMware Tools) and the guest's package-management policy. Verify that automatic upgrade behavior matches the organization's approved change-management model.

How it is fixed

Fix method: Guidance or infrastructure patch

To remediate this recommendation, enable automatic VMware Tools upgrades only where appropriate, or configure a controlled centralized update process. In vSphere select the approved 'check and upgrade Tools during power cycling' behavior as appropriate for the environment.

Properties

Operating systems: Any
Tags: vmwareesxivmware-tools
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 8.3 VMware Tools should configure automatic upgrades as appropriate for the environment