When you use independent nonpersistent disks, successful attackers can remove any evidence that the machine was compromised by shutting down or rebooting the system. Without a persistent record of activity on a virtual machine, administrators might be unaware of an attack. Therefore, you should avoid using independent nonpersistent disks.


  • Ensure that virtual machine activity is logged remotely on a separate server, such as a syslog server or equivalent Windows-based event collector.
    If remote logging of events and activity is not configured for the guest, scsiX:Y.mode should be one of the following settings:
    • Not present
    • Not set to independent nonpersistent


When nonpersistent mode is not enabled, you cannot roll a virtual machine back to a known state when you reboot the system.