None Computing title Omnissa Horizon Agent Security Technical Implementation Guide version 1 releaseinfo Release: 1 Vuln_Num V-286829 Rule_ID SV-286829r1294194_rule Severity medium Rule_Title The Horizon Agent must set a session idle timeout. Vuln_Discuss Idle sessions present an increased risk of being hijacked. If a user steps away from their desk and is no longer in positive control of their session, that session is in danger of being assumed by another user. Idle sessions can also waste valuable datacenter resources, which in turn may lead to a lack of resources for new, active users. An organizationally defined idle timeout value must be configured to override the Horizon default value of "never". Satisfies: SRG-APP-000003, SRG-APP-000190 Check_Content Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting. If "Idle Time Until Disconnect (VDI)" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "Idle Timeout", if "Never" is selected, this is a finding. Double-click the "RDS Idle Time Until Disconnect" setting. If "RDS Idle Time Until Disconnect" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "RDS Idle Timeout", if "Never" is selected, this is a finding. Fix_Text Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting. Verify "Idle Time Until Disconnect (VDI)" is set to "Enabled". In the drop-down menu next to "Idle Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK". Double-click the "RDS Idle Time Until Disconnect" setting. Verify "RDS Idle Time Until Disconnect" is set to "Enabled". In the drop-down menu next to "RDS Idle Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK". Not_Reviewed Vuln_Num V-286830 Rule_ID SV-286830r1289265_rule Severity medium Rule_Title The Horizon Agent must set a disconnected session time limit. Vuln_Discuss Disconnected sessions present an increased risk of being hijacked. If a user steps away from their desk, that disconnected session is in danger of being reinstantiated by another user. Disconnected sessions can also waste valuable datacenter resources, which in turn may lead to a lack of resources for new, active users. An organizationally defined disconnected session timeout value must be configured to override the Horizon default value of "never". Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Disconnected Session Time Limit (VDI)" setting. If "Disconnected Session Time Limit (VDI)" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "Disconnect Timeout", if "Never" is selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Disconnected Session Time Limit (VDI)" setting. Verify "Disconnected Session Time Limit (VDI)" is set to "Enabled". In the drop-down menu next to "Disconnect Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK". Not_Reviewed Vuln_Num V-286831 Rule_ID SV-286831r1289266_rule Severity medium Rule_Title The Horizon Agent must set an RDS connection to disconnect after an organization-defined maximum time. Vuln_Discuss Horizon VDI is intended to provide remote desktops and applications, generally during working hours, and for no more than an extended workday. Leaving sessions active for more than what is reasonable for a work day opens the possibility of a session becoming unoccupied and insecure on the client side. For example, if a client connection is opened at 0900, there are few day-to-day reasons that the connection should still be open after 1900; therefore, the connection must be terminated. If the user is still active and environment settings allow it, they can reauthenticate immediately and continue the session. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Connection Time Until Disconnect" setting. If "RDS Connection Time Until Disconnect" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "RDS Connection Timeout", if "Never" is selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Connection Time Until Disconnect" setting. Verify "RDS Connection Time Until Disconnect" is set to "Enabled". In the drop-down menu next to "RDS Connection Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK". Not_Reviewed Vuln_Num V-286832 Rule_ID SV-286832r1289267_rule Severity medium Rule_Title The Horizon Agent must set an RDS disconnected session time limit. Vuln_Discuss Disconnected sessions present an increased risk of being hijacked. If a user steps away from their desk, that disconnected session is in danger of being reinstantiated by another user. Disconnected sessions can also waste valuable datacenter resources, which may lead to a lack of resources for new, active users. An organizationally defined disconnected RDS session timeout value must be configured to override the default value of "never". Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Disconnected Time Until Logoff" setting. If "RDS Disconnected Time Until Logoff" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "RDS Disconnect Timeout", if "Never" is selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Disconnected Time Until Logoff" setting. Verify "RDS Disconnected Time Until Logoff" is set to "Enabled". In the drop-down menu next to "RDS Disconnect Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK". Not_Reviewed Vuln_Num V-286833 Rule_ID SV-286833r1289263_rule Severity high Rule_Title The Horizon Agent must be installed in FIPS mode. Vuln_Discuss Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot be relied upon to provide confidentiality or integrity, and DoW data may be compromised due to weak algorithms or poor implementation. The Horizon Connection Server and Agent can both be configured to exclusively use FIPS 140-3-validated cryptographic modules but only at installation time, not post deployment. Reference Horizon documentation for up-to-date requirements for enabling FIPS during the Horizon Agent install. Satisfies: SRG-APP-000439, SRG-APP-000014, SRG-APP-000015, SRG-APP-000156, SRG-APP-000157, SRG-APP-000179, SRG-APP-000183, SRG-APP-000219, SRG-APP-000224, SRG-APP-000231, SRG-APP-000440, SRG-APP-000514, SRG-APP-000555, SRG-APP-000560, SRG-APP-000565, SRG-APP-000585, SRG-APP-000600, SRG-APP-000610, SRG-APP-000630, SRG-APP-000635, SRG-APP-000645 Check_Content On the template Virtual Machine or on a resultant cloned machine where the Horizon Agent is installed, launch the Registry Editor. Navigate the registry tree to "HKLM\Software\Omnissa\Horizon" and locate the "FipsMode" key. If "FipsMode" does not exist, or does not have a value of "1", this is a finding. Fix_Text FIPS mode can only be implemented during installation. Reinstall the Horizon Agent on the template Virtual Machine and select the option to enable FIPS mode. Note: The Horizon Agent can only be installed in FIPS mode if the Windows machine itself is running in FIPS mode. Not_Reviewed Vuln_Num V-286834 Rule_ID SV-286834r1288267_rule Severity medium Rule_Title The Horizon Agent must disable access to a virtual desktop infrastructure (VDI) PC-over-IP (PCoIP) session from a vSphere console. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to be viewed by authorized individuals. By default, the Horizon Agent does not allow access to a PCoIP session from a vSphere console. This configuration option must be validated and maintained over time. Note: This control applies to VDI PCoIP sessions, and not RDSH sessions. Check_Content Verify the "pcoip.admx" template has been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops. Navigate to Computer Configuration >> Policies >> Administrative Templates >> PCoIP Session Variables >> Not Overridable Administrator Settings. If "Enable access to a PCoIP session from a vSphere console" is set to "Enabled", this is a finding. Fix_Text Verify the "pcoip.admx" template has been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> PCoIP Session Variables >> Not Overridable Administrator Settings. Double-click the "Enable access to a PCoIP session from a vSphere console" setting. Verify "Enable access to a PCoIP session from a vSphere console" is set to "Disabled". Click "OK". Not_Reviewed Vuln_Num V-286835 Rule_ID SV-286835r1288270_rule Severity medium Rule_Title The Horizon Agent must enable screen blanking for Blast to disable access to a VDI Blast session from a vSphere console. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to be viewed by authorized individuals. By default, the Horizon Agent will display a blank screen for an active session when accessed through the VM console, but allows for mirroring the Blast screen to the VM console. This configuration option must be disabled, validated and maintained over time. Note: This control applies to VDI Blast sessions, and not RDSH sessions. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Blast. If "Screen Blanking" is set to "Disabled" or "Not Configured", this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Blast. Double-click the "Screen Blanking" setting. Verify "Screen Blanking" is set to "Enabled". Click "OK". Not_Reviewed Vuln_Num V-286836 Rule_ID SV-286836r1294392_rule Severity medium Rule_Title The Horizon Agent must block USB mass storage. Vuln_Discuss The Horizon Agent has the capability to granularly control what, if any, USB devices are allowed to be passed from the local client to the agent on the virtual desktop. By default, Horizon blocks certain device families from being redirected to the remote desktop or application. While there are legitimate reasons to pass USB devices to the desktop, these must be carefully analyzed for necessity. At a minimum, USB Mass Storage devices must never be passed through, in keeping with DoW data loss prevention policies. As thumb drives are disallowed for physical PCs, so should they be for virtual desktops. This can be accomplished in several ways, including natively in the Horizon Agent. Check_Content USB mass storage devices can be blocked in a number of ways: 1. The desktop OS. 2. A third party DLP solution. 3. The "USB Redirection" optional Horizon Agent feature not being selected during install on any VDI image. 4. On the Connection Server via individual pool policies or global policies. If any of these methods are already employed, the risk is already addressed and this requirement is not applicable. If USB devices are not otherwise blocked, the Horizon Agent must be configured to block storage devices. Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Horizon USB Configuration. Option 1: Allow all, deny by exception. Verify "Exclude All Devices" is set to "Not Configured" or "Disabled". If "Exclude Device Family" is not set to "Enabled" with the value "o:storage" included, this is a finding. Option 2: Deny all, allow by exception. Verify "Exclude All Devices" is set to "Enabled". If "Include Device Family" is set to "Enabled" and includes the value "storage", this is a finding. If either option above is true, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Horizon USB Configuration. Option 1: Allow all, deny by exception. Set "Exclude All Devices" to "Not Configured" or "Disabled". Set "Exclude Device Family" to "Enabled" with the value "o:storage" included. Option 2: Deny all, allow by exception. Set "Exclude All Devices" to "Enabled". Set "Include Device Family" to not contain "a:storage" or "o:storage". Click "OK". Not_Reviewed Vuln_Num V-286837 Rule_ID SV-286837r1288276_rule Severity medium Rule_Title The Horizon Agent must not allow client drive redirection. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Client, Agent, and guest operating systems will coordinate to allow drives local to the client to be redirected over the Client connection and mounted in the virtual desktop. This configuration must be modified to disallow drive sharing to protect sensitive DoW data from being maliciously, accidentally, or casually removed from the controlled environment. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection. Double-click the "Do not allow drive redirection" setting. If "Do not allow drive redirection" is not set to "Enabled", this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection. Double-click the "Do not allow drive redirection" setting. Verify "Do not allow drive redirection" is set to "Enabled". Click "OK". Not_Reviewed Vuln_Num V-286838 Rule_ID SV-286838r1288279_rule Severity medium Rule_Title The Horizon Agent must audit clipboard actions. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Agent will block clipboard "copy/paste" actions from the VDI desktop to the client but will allow "copy/paste" actions from the client to the VDI desktop. All such allowed actions must be audited for potential future forensic purposes. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure clipboard audit" setting. If "Configure clipboard audit" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu under "Configure clipboard audit", if "Enabled in both directions" is not selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure clipboard audit" setting. Verify "Configure clipboard audit" is set to "Enabled". In the drop-down menu under "Configure clipboard audit", select "Enabled in both directions". Click "OK". Not_Reviewed Vuln_Num V-286839 Rule_ID SV-286839r1288282_rule Severity medium Rule_Title The Horizon Agent must not allow file transfers. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Agent will allow file transfers from the client to the VDI desktop. This must be configured to be disabled in both directions. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure file transfer" setting. If "Configure file transfer" is not set to "Enabled", this is a finding. In the drop-down menu under "Configure file transfer", if "Disabled both upload and download" is not selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure file transfer" setting. Verify "Configure file transfer" is set to "Enabled". In the drop-down menu under "Configure file transfer", select "Disabled both upload and download". Click "OK". Not_Reviewed Vuln_Num V-286840 Rule_ID SV-286840r1288285_rule Severity medium Rule_Title The Horizon Agent must not allow drag and drop. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Agent will allow drag and drop actions from the client to the VDI desktop. This must be configured to be disabled in both directions. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Drag and Drop. Double-click the "Configure drag and drop direction" setting. If "Configure drag and drop direction" is not set to "Enabled", this is a finding. In the drop-down menu under "Configure drag and drop", if "Disabled in both directions" is not selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Drag and Drop. Double-click the "Configure drag and drop direction" setting. Verify "Configure drag and drop direction" is set to "Enabled". In the drop-down menu under "Configure drag and drop", select "Disabled in both directions". Click "OK". Not_Reviewed Vuln_Num V-286841 Rule_ID SV-286841r1288288_rule Severity medium Rule_Title The Horizon Agent must not redirect client printers. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Client, Agent, and guest operating systems will coordinate to allow printers local to the client to be redirected over the Client connection and made available in the virtual desktop. This configuration must be modified to disallow printer redirection to protect sensitive DoW data from being maliciously, accidentally, or casually printed from the controlled environment. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Omnissa Integrated Printing. If "Do not redirect client printer(s)" is set to "Not Configured" or "Disabled", this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Omnissa Integrated Printing. Double-click the "Do not redirect client printer(s)" setting. Verify "Do not redirect client printer(s)" is set to "Enabled". Click "OK". Not_Reviewed Vuln_Num V-286842 Rule_ID SV-286842r1288291_rule Severity medium Rule_Title The Horizon Agent must block VDI desktop-to-client clipboard actions. Vuln_Discuss Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Agent will block clipboard "copy/paste" actions from the VDI desktop to the client but will allow those actions from the client to the VDI desktop. This configuration must be validated and maintained over time. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure clipboard redirection" setting. If "Configure clipboard redirection" is set to either "Not Configured" or "Disabled", this is not a finding. In the drop-down menu under "Configure clipboard redirection", if either "Enabled server to client only" or "Enabled in both directions" is selected, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection. Double-click the "Configure clipboard redirection" setting. Option 1: Allow copy/paste from the client to the virtual desktop, but not the reverse. This is the default behavior. Verify "Configure clipboard redirection" is set to "Disabled". Click "OK". Option 2: Disallow all clipboard sharing between the client and the virtual desktop. Verify "Configure clipboard redirection" is set to "Enabled". From the drop-down menu, select "Disabled in both directions". Click "OK". Not_Reviewed Vuln_Num V-286843 Rule_ID SV-286843r1288294_rule Severity medium Rule_Title The Horizon Agent must only run allowed scripts on user connect. Vuln_Discuss The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnConnect" setting. If "CommandsToRunOnConnect" is set to either "Not Configured" or "Disabled", this is not a finding. Click the "Show..." button next to "Commands". If there are any commands listed that are not required, expected, and approved, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnConnect" setting. Option 1: Verify "CommandsToRunOnConnect" is set to "Disabled". Click "OK". Option 2: Verify "CommandsToRunOnConnect" is set to "Enabled". Click the "Show..." button next to "Commands". Highlight each unapproved command and press the "Delete" key. Click "OK". Click "OK". Not_Reviewed Vuln_Num V-286844 Rule_ID SV-286844r1288297_rule Severity medium Rule_Title The Horizon Agent must disable TrueSSO. Vuln_Discuss The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration >> TrueSSO Configuration. Double-click the "Disable TrueSSO" setting. If "Disable TrueSSO" is set to either "Not Configured" or "Disabled", this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration >> TrueSSO Configuration. Double-click the "Disable TrueSSO" setting. Verify "Disable TrueSSO" is set to "Enabled". Click "OK". Not_Reviewed Vuln_Num V-286845 Rule_ID SV-286845r1288300_rule Severity medium Rule_Title The Horizon Agent must validate the entire issuance chain of certificates. Vuln_Discuss The Horizon Agent validates certificate issuance chains up to, but not including the root certificate authority (CA) by default. This behavior must be changed to validate the entire chain, including root. Check_Content Verify the "hzn_common.admx" template has been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Common Configuration >> Security Configuration. Double-click the "Type of certificate revocation check" setting. If "Type of certificate revocation check" is not set to "Enabled", this is a finding. In the drop-down menu below "Type of certificate revocation check", if "WholeChain" is not selected, this is a finding. Fix_Text Verify the "hzn_common.admx" template has been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Common Configuration >> Security Configuration. Double-click the "Type of certificate revocation check" setting. Verify "Type of certificate revocation check" is set to "Enabled". In the drop-down menu below "Type of certificate revocation check", select "WholeChain". Click "OK". Not_Reviewed Vuln_Num V-286846 Rule_ID SV-286846r1294231_rule Severity high Rule_Title The Horizon Agent must be a version supported by Omnissa. Vuln_Discuss Unsupported software and systems should not be used because fixes to newly identified bugs will not be implemented by the vendor. The lack of support can result in potential vulnerabilities. Software and systems at unsupported servicing levels or releases will not receive security updates for new vulnerabilities, which leaves them subject to exploitation. When maintenance updates and patches are no longer available, software is no longer considered supported and should be upgraded or decommissioned. Check_Content On the template virtual machine or on a resultant cloned machine where the Horizon Agent is installed, launch the Registry Editor. Navigate the registry tree to "HKLM\Software\Omnissa\Horizon" and locate the "ProductVersion" key. If the value of "ProductVersion" is not a supported version, this is a finding. Fix_Text On the template virtual machine, remove the outdated agent and install the latest version supported by the Connection Server. Not_Reviewed Vuln_Num V-286847 Rule_ID SV-286847r1288306_rule Severity medium Rule_Title The Horizon Agent must only run allowed scripts on user disconnect. Vuln_Discuss The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnDisconnect" setting. If "CommandsToRunOnDisconnect" is set to either "Not Configured" or "Disabled", this is not a finding. Click the "Show..." button next to "Commands". If there are any commands listed that are not required, expected, and approved, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnDisconnect" setting. Option 1: Verify "CommandsToRunOnDisconnect" is set to "Disabled". Click "OK". Option 2: Verify "CommandsToRunOnDisconnect" is set to "Enabled". Click the "Show..." button next to "Commands". Highlight each unapproved command and press the "Delete" key. Click "OK". Click "OK". Not_Reviewed Vuln_Num V-286848 Rule_ID SV-286848r1288309_rule Severity medium Rule_Title The Horizon Agent must only run allowed scripts on user reconnect. Vuln_Discuss The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times. Check_Content Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnReconnect" setting. If "CommandsToRunOnReconnect" is set to either "Not Configured" or "Disabled", this is not a finding. Click the "Show..." button next to "Commands". If there are any commands listed that are not required, expected, and approved, this is a finding. Fix_Text Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnReconnect" setting. Option 1: Verify "CommandsToRunOnReconnect" is set to "Disabled". Click "OK". Option 2: Verify "CommandsToRunOnReconnect" is set to "Enabled". Click the "Show..." button next to "Commands". Highlight each unapproved command and press the "Delete" key. Click "OK". Click "OK". Not_Reviewed