Device Control limitations in VMWare Environments

Introduction

The Device Control feature has limitations working with virtual machines in VMWare Hypervisors.

Problem

In VMWare virtual environments, shared virtual storage devices, like iSCSI, present to the VM as if it is a hot swappable device, like a USB device. VMWare makes them hot pluggable to support dynamically resizing volumes.

This can cause issues when Device Control is enabled in modes where blocking writes / reads from external devices are configured. Despite this being an 'internal' drive on the VM, it is a shared, hot swappable storage device.

Solution

The solution is to have the VM not view the iSCSI device as hot swappable per the following method:

1. From a web browser, connect to the vSphere Web Client.
2. Log in with Administrator credentials.
3. Navigate to the virtual machine you want to modify.
4. Power off the virtual machine.
5. Right-click the virtual machine and select Edit Settings.
6. Click the VM Options tab.
7. Click Advanced > Edit Configuration.
8. Either select Add Row, or enter the values directly into the provided fields at the bottom.
9. Insert a new row with the name devices.hotplug and a value of false.
10. Power on the virtual machine.

Changing the drive to not present as hot swappable should allow Device Control to ignore the 'internal' drive as a removable device. If you need to keep the device in this state, be aware that Device Control settings could interfere with the VM and 'internal' disks and should be configured accordingly.

Further info from VMWare specifically can be found here: https://kb.vmware.com/s/article/1012225