V-286847

Discussion

The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times.

Check Content

Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration.

Double-click the "CommandsToRunOnDisconnect" setting.

If "CommandsToRunOnDisconnect" is set to either "Not Configured" or "Disabled", this is not a finding.

Click the "Show..." button next to "Commands". If there are any commands listed that are not required, expected, and approved, this is a finding.