V-287321

Discussion

The Horizon Client supports a variety of command line parameters, including options related to user authentication. In certain deployment scenarios, administrators or users may create scripts or shortcuts that invoke the Horizon Client with authentication-related parameters. If sensitive authentication information such as a smart card PIN, password, or other authenticator, is embedded within these scripts, command lines, batch files, or configuration files, the information may be stored in clear text on the local system. Storage of authenticators in plain text exposes them to unauthorized disclosure through file access, system backups, log files, process inspection, or other means available to malicious users or malware. Compromise of these authenticators could enable unauthorized access to enterprise resources and undermine the effectiveness of multifactor authentication mechanisms. To reduce this risk, organizations must prohibit the hard-coding or storage of credentials, smart card PINs, passwords, tokens, or other sensitive authentication information in scripts, shortcuts, configuration files, automated login processes, or any other persistent storage location. Authentication information must be entered interactively by the user or protected through approved enterprise credential management solutions in accordance with organizational security policies.

Check Content

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings. 

If "Allow command line credentials" is set to "Not Configured" or "Enabled", this is a finding.