Custom access protection for VMware Workstation Virtual machines

When multiple users share access to the virtual machine, the VMware administrator should consider limiting the virtual machine configuration and updating functions. This avoids unexpected or malicious changes to virtual machines. It is easy to set in VMware Workstation.

Restrictions on access to VMware Workstation Shared Virtual Machine configurations are useful in the teaching environment, because students may modify Virtual Machine configurations, and restrictions on shared virtual machine configurations are also useful for information display screens, because Virtual Machine-USB connection may introduce viruses or other malware.

Encryption is a method of controlling access to virtual machines in Workstation. Without a password, all contents of the virtual machine cannot be accessed. However, encryption is a desperate solution. Restricted virtual machines can be modified through application policies. For example, you may disable virtual machine hardware modification, but allow you to add or delete USB devices.

Encryption protects virtual machines at startup, but limits allow users to execute necessary tasks while ensuring that users cannot access the configurations of virtual machines. Password-protected restricted virtual machines avoid upgrading to the new version of VMware software without authorization, and changing the configuration or hardware.

How to restrict VMware Workstation Shared virtual machines

On the Workstation Main Menu, use "Edit Virtual Machine Settings" to control the restrictions on virtual machines. Under the option tab, you can see that all the options under the "Access Control" sub-options are disabled (figure 1 ).

Figure 1. The VMware Workstation access control link is used to set how to change the encryption and restriction options of virtual machines

If you select "enable limit", you can set two other virtual machine protection policies, which allow virtual machines to connect to USB devices by default. You may want to disable VM-USB connections in several scenarios, such as when a virtual machine contains important information. Allow a VM to connect to a USB device, which means that the VM user is allowed to copy data from the VM. The USB connection option puts the virtual machine at the risk of malware and virus attacks. This option should be disabled unless necessary.

Another policy setting for a restricted virtual machine requires the user to change the password. This option is disabled by default. If this option is enabled, you must set a new restricted password before moving or copying the virtual machine. This option is useful if you want to share a virtual machine with your colleagues, but it is usually useless in the teaching environment, in the teaching environment, users should set their own restricted passwords and then make any changes to the virtual machine.

Like encrypted virtual machines, restrictions on VMware Workstation Shared virtual machines are equally risky. What if the password is lost? In this case, the restricted virtual machine cannot be modified any more.