Protecting a virtual machine from changes

[Hans Ritter]

Hello,

I want to install a virtual machine (Windows 11) on a system running VMware Workstation (version 26H1). That part is no problem. I am also encrypting all the files, which is fine too.

 

However, I want to prevent anyone from changing the machine's settings. Users should be allowed to use the VM, but only specific administrators should be permitted to modify the settings.

 

VMware Workstation used to have an "Access Control" section, but that no longer exists.

 

In my research, I read that this might be possible using `dicttool`, but I cannot find any documentation on the commands for it.

 

It cannot be done via Windows ACLs. I tried setting the VMX file to read-only for the user, but then they couldn't start the machine because VMware writes to the VMX file while the machine is running.

 

Do you have any tips or ideas on how I can solve this?

 

Thanks in advance to everyone.

Feedback geben

[Hans Ritter]

@James Lin

Can you help by this question?

[James Lin]

However, I want to prevent anyone from changing the machine's settings. Users should be allowed to use the VM, but only specific administrators should be permitted to modify the settings.

This is not possible.  I would suggest running the VM from an administrator's account and then having users connect to it remotely (even if on the same physical machine).  For Windows guests, you could use Remote Desktop.  For VMs in general, you can enable the built-in VNC server and then connect to the VMs with a VNC client.

VMware Workstation used to have an "Access Control" section, but that no longer exists.

The "Access Control" panel was renamed back to "Encryption" since it's all it's used for now.

In my research, I read that this might be possible using `dicttool`, but I cannot find any documentation on the commands for it.

All of the documentation for dictTool can be obtained by running dictTool --help.  However, that won't help you in this regard either.

[Hans Ritter]

 VMware Workstation used to have an "Access Control" section, but that no longer exists.

 

         The "Access Control" panel was renamed back to "Encryption" since it's all it's used for now.

And that is precisely the problem-why was this useful feature removed? You could simply set a password, and the machine was protected against changes. That should have been kept.

[James Lin]

I wasn't involved when that feature was removed, but my understanding is that:

1. The restricted VMs feature was added primarily to support VMware Horizon FLEX.  With that product discontinued long ago, there is no longer business justification to continue supporting it.

2. Telemetry data indicated that the restricted VMs feature was rarely used.  It was removed in VMware Workstation 16 in 2020, and there have been very few complaints.

3. The restricted VMs feature was not a small, isolated feature.  Because it impacted all other virtual machine settings, keeping that feature around created a very large maintenance and testing burden.

4. The restricted VMs feature made VM configuration tamper-resistant, not tamper-proof.  It ultimately relied on security-through-obscurity.  In principle, a user with the encryption password but not the restrictions password could--with enough technical knowledge--still modify the VM configuration.

[kasper]

It sounds like the user has direct access to the physical machine and to the VMWare Workstation console program.   Look at something like a 'kiosk' mode setup, or possibly use a ram disk, or ideally vnc/rdp depending on the apps.