V-287326

Discussion

Preventing the disclosure of transmitted information requires that the device or machine take measures to employ cryptographic mechanism to protect the information during transmission. This is usually achieved using Transport Layer Security (TLS). The Horizon Client connects to the Connection Server, UAG, or other gateway via a TLS connection. This initial connection must be trusted, otherwise the sensitive information flowing over the tunnel could potentially be open to interception. The Horizon Client can be configured to not check certificate revocation status. This must not be allowed and must be validated and maintained over time.

Check Content

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Security Settings.

Double-click "Do not check certificate revocation status".

If "Do not check certificate revocation status" is set to "Enabled", this is a finding.