V-286842

Discussion

Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Agent will block clipboard "copy/paste" actions from the VDI desktop to the client but will allow those actions from the client to the VDI desktop. This configuration must be validated and maintained over time.

Check Content

Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Clipboard Redirection.

Double-click the "Configure clipboard redirection" setting.

If "Configure clipboard redirection" is set to either "Not Configured" or "Disabled", this is not a finding.

In the drop-down menu under "Configure clipboard redirection", if either "Enabled server to client only" or "Enabled in both directions" is selected, this is a finding.