Rule ID
SV-286830r1289265_rule
Version
V1R1
CCIs
Disconnected sessions present an increased risk of being hijacked. If a user steps away from their desk, that disconnected session is in danger of being reinstantiated by another user. Disconnected sessions can also waste valuable datacenter resources, which in turn may lead to a lack of resources for new, active users. An organizationally defined disconnected session timeout value must be configured to override the Horizon default value of "never".
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Disconnected Session Time Limit (VDI)" setting. If "Disconnected Session Time Limit (VDI)" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "Disconnect Timeout", if "Never" is selected, this is a finding.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "Disconnected Session Time Limit (VDI)" setting. Verify "Disconnected Session Time Limit (VDI)" is set to "Enabled". In the drop-down menu next to "Disconnect Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK".