VMware vSphere 8.0 vCenter Security Technical Implementation Guide

The VMware vSphere 8.0 vCenter Security Technical Implementation Guide (V2 R5) has 67 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

67STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R5

CurrentPublished Wed Sep 30 2026

The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

VMware vSphere 8.0 vCenter Security Technical Implementation Guide

Assessment Title

Rule Text

The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

Description

Discussion Text

By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute forcing, is reduced. Limits are imposed by locking the account.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-258924

Rule

SV-258924r961368_rule

Severity

medium

Rule Version

VCSA-80-000145

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Local Accounts >> Lockout Policy.

View the value of the "Time interval between failures" setting.

Time interval between failures: 900 seconds

If the lockout policy is not configured with "Time interval between failures" policy of "900" or more, this is a finding.

Implementation Procedure

Fix Text

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Local Accounts >> Lockout Policy.

Click "Edit".

Set the "Time interval between failures" to "900" and click "Save".

STIG check 20 of 67 in the VMware vSphere 8.0 vCenter STIG checklist

← Previous · V-258923The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action.Next · V-258925 →The vCenter Server must be configured to send logs to a central log server.