Pau Lo
asked on
admin role in vcenter
can anyone provide some examples of the kind of issue/risk if an unauthorised user gained access to vcenter with an account with the admin role permissions. I am trying to gauge the potential risk if this ever happened.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Yes, an Admin could do the following:-
1. Power off VM.
2. Copy the Virtual Machine Disk to local laptop.
3. Mount the virtual machine disk (VMDK) as a drive letter, overcoming ANY OS Active Directory or Unix Login.
4. Inspect the data.
Easy!
if you wanted to do this secretly, without turning off the VM.
1. Clone the VM, whilst the VM was on.
2. Copy the Virtual Machine CLONE Disk to local laptop.
3. Delete the CLONE VM.
4. 3. Mount the virtual machine disk (VMDK) as a drive letter, overcoming ANY OS Active Directory or Unix Login.
4. Inspect the data.
Easy!
Virtualisation Administrators have more POWER, than your usual Domain Administrators!
Domain Administrators are responsible for Microsoft Active Directory Management (e.g Domain, usernames and accounts, passwords , group policy).
Virtualisation Administrators are not often Domain Administrators, but they can be!
1. Power off VM.
2. Copy the Virtual Machine Disk to local laptop.
3. Mount the virtual machine disk (VMDK) as a drive letter, overcoming ANY OS Active Directory or Unix Login.
4. Inspect the data.
Easy!
if you wanted to do this secretly, without turning off the VM.
1. Clone the VM, whilst the VM was on.
2. Copy the Virtual Machine CLONE Disk to local laptop.
3. Delete the CLONE VM.
4. 3. Mount the virtual machine disk (VMDK) as a drive letter, overcoming ANY OS Active Directory or Unix Login.
4. Inspect the data.
Easy!
Virtualisation Administrators have more POWER, than your usual Domain Administrators!
Domain Administrators are responsible for Microsoft Active Directory Management (e.g Domain, usernames and accounts, passwords , group policy).
Virtualisation Administrators are not often Domain Administrators, but they can be!
ASKER