CCS ESXi Checks are not working as expected with the 'isolation.tools.diskShrink.disable' parameter

Products

• Control Compliance Suite Standards Server
• Control Compliance Suite
• Control Compliance Suite Standards Module

Issue/Introduction

Using predefined standards (CIS Benchmark checks) for testing ESXi,  the parameter is correctly configured on the ESXi host but CCS is still reporting the message below:

The following Guest operating systems do not have the parameter present on the system:

Guest Operating System: <hostname>     Parameter Name: isolation.tools.diskShrink.disable

 

Environment

Release : CCS 12.5.x and CCS 12.6.x

Cause

This error is from the check '8.6.2 (L1) Ensure virtual disk shrinking is disabled' in the CIS Benchmark Vmware ESXi 7.0 Level 1 V1.0.0 standard.

Resolution

As per the CIS Benchmark Vmware ESXi 7.0 Level 1 V1.0.0 pdf documentation in the Remediation section, run a PowerCLI command prompt while connected to the ESXi host or vCenter server and run the following command to verify that the setting is set to 'true' on the active virtual machine that CCS is reporting the error:

Get-VM | Get-AdvancedSetting -Name "isolation.tools.diskShrink.disable" | Select Entity, Name, Value

If the virtual machine advanced setting isolation.tools.diskShrink.disable does not exist or is not set to true, this is why the check is failing. 

NOTE: As per VMWare documentation, whether you change a virtual machine’s settings in the vSphere Client, in a vSphere API-based tool, or using a text editor, you must restart the virtual machine for most changes to take effect.  That is why getting results of the PowerCLI command will reflect what is currently applied to the virtual machine, and that will mimic what CCS is checking as the CCS check will verify what is currently set on the active virtual machine.  It could be that the parameter has been changed in the configuration, but the virtual machine has not been restarted and so it has not yet been applied to the active virtual machine.