VMware has released the public draft vSphere 5.1 hardening guide

When implementing virtualization technology, organizations must ensure that they can continue to maintain a secure environment and meet their compliance obligations. To do so, you will have to evaluate risks that might affect protected information and mitigate those risks through risk-appropriate standards, processes, and best practices.

The draft version of the vSphere 5.1 Hardening Guide provides guidance on how to securely deploy VMware vSphere 5.1 in a production environment. The focus is on initial configuration of the virtualization infrastructure layer, which covers the following:

• The virtualization hosts 
• Configuration of the virtual machine container (NOT hardening of the guest operating system (OS) or any applications running within)
• Configuration of the virtual networking infrastructure, including the management and storage networks as well as the virtual switch (but NOT security of the virtual machine’s network)
• VMware vCenter Server, its database and client components
  
  Public Draft (Revision A) of the vSphere 5.1 Security Hardening Guide
  http://communities.vmware.com/servlet/JiveServlet/downloadBody/21732-102-2-28939/HardeningGuide-vSphere5-1.Draft%20RevA.xlsx

Finding and removing unused replica virtual machines in VMware View/vCenter

Finding and removing unused replicas

To find and remove unused replicas:  

1. On the vCenter Server, stop the VMware View Composer service.
   
   Note: While this Service is down no recompose, refresh, or provisioning operations occur. Use a convenient maintenance window.
   
   
2. Click Start.
3. Type Services.
4. Press Enter.
5. Click the VMware View Composer Service.
6. Click Stop.
7. Open a command prompt.
   
   Note: In Windows Server 2008 machines, the command prompt must be run as an Administrator. To run the command prompt as an Administrator:
8. 1. Click Start, type cmd, and press Enter.
   2. Hold Ctrl + Shift, and press Enter.
      
9. Navigate to the View Composer install directory.
10. • On a Windows 32-bit server, navigate to C:\Program Files\VMware\VMware View Composer.
    • On a Windows 64-bit server, navigate to C:\Program Files (x86)\VMware\VMware View Composer.
11. Run the sviconfig.exe command with the FindUnusedReplica operation:
    
    SviConfig.exe -operation=FindUnusedReplica -DsnName=<the name of the Composer database DSN> -Username=<the user name of Composer database owner> -Password=<the password of Composer database owner>
    For example:
    
    SviConfig.exe -operation=FindUnusedReplica -DsnName=ComposerDB -Username=sa -Password=secret
    Notes: 
    • If the DsnName contains spaces, use quotes around the value.
    •  To determine the Composer DB DSN, user and password, see Determining the Composer DB DSN, username, and password.
      
12. If the command finds any unused replicas, they are listed in a new file created in the current directory (unused-replica-*.txt).
13. Unused replicas can be unprotected and moved to a unique folder with the parameter:
    
    -move=true
    
    For example:
    
    SviConfig.exe -operation=FindUnusedReplica -DsnName=ComposerDB -Username=sa -Password=secret -Move=true
    Note: When using the move=true option, you will receive warning pop-ups.  These are safe to ignore.
    Note: The UnusedViewComposerReplicaFolder is created automatically if it does not exist, and unused replicas are moved to this folder.
    
    
14. Open a vSphere Client and connect to vCenter Server.
15. Click Inventory > VMs and Templates.
16. Remove the replicas located in the UnusedViewComposerReplicaFolder.
17. Start the VMware View Composer service.

Determining the Composer DB DSN, username, and password

To determine the Composer DB DSN, user and password:

1. On the vCenter Server hosting the Composer service, click Start > Programs > Administrative Tools > Data Sources (ODBC).
2. Click the System DSN tab.
3. Click the Composer database entry. This is the value you enter for DsnName in the sviconfig command.
4. Click Edit.
5. The username is visible, and should match the entry in the Composer configuration in View Manager.