Rule ID
SV-287318r1294248_rule
Version
V1R1
CCIs
Horizon Connection Server can allow clients to authenticate using the local session credentials of their local endpoint. While convenient, this must be disabled for DoW deployments as the server cannot ascertain the method of endpoint login, whether that user's client certificate has since been revoked, and other reasons. This option is disabled in the Horizon Connection Server STIG and must also be disabled on the client.
Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Display option to Log in as current user". If "Display option to log in as current user" is not set to "Disabled", this is a finding.
Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines. Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. Double-click "Display option to log in as current user". Verify "Display option to log in as current user" is set to "Disabled". Click "OK".