Protect VMware Workstation shared VMs with custom access settings

How to restrict VMware Workstation shared VMs

Control VM restrictions via "Edit virtual machine settings" in Workstation's main interface. Under the Options tab, you'll see "Access Control," with all options disabled (Figure 1).

Figure 1. The VMware Workstation Access Control link is how you'll change the encryption and restriction options for a VM.

When you select "Enable Restrictions," you can apply two additional VM protection policy settings. The option to allow USB devices to connect to the VM is on by default. There are several scenarios in which you would want to disable VM-USB connections -- for instance, on VMs that contain valuable information. By allowing USB devices to connect with the VM, you allow the VM's user to copy content from it. The USB connection option exposes the VM to the risk of malware and viruses. To mitigate these risks, disable this option unless it is needed.

The other policy setting for restricted virtual machines is the option that requires a user to change the password. This option is off by default. If it is selected, a user that moves or copies the VM will have to first set a new restriction password. This option is useful if you want to share a VM with peers, but it is typically not helpful in a classroom environment, where users could set their own restriction passwords and then make VM modifications at will.

Just as with encrypting VMs, there are risks to setting restrictions on VMware Workstation shared VMs. What happens if you lose the password? Restricted VMs can never be modified again.