V-287323

Discussion

The Horizon Client provides an option to save user credentials to facilitate subsequent authentications to a Horizon Connection Server. When this feature is enabled, the user's password is stored locally on the endpoint system. Storage of authentication credentials on the client system increases the risk of credential compromise through unauthorized access to the endpoint, malware infection, registry inspection, backup media exposure, or other forms of system compromise. An attacker who obtains stored credentials may be able to authenticate as the authorized user and gain access to virtual desktop resources, applications, and organizational information. The storage of passwords on endpoint devices is inconsistent with DoW security principles that require protection of authenticators and minimization of credential exposure. To reduce the risk of unauthorized access, the Horizon Client must not be configured to store logon passwords.

Check Content

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Scripting definitions.

If "Logon Password" is set to "Enabled", this is a finding.