V-286756

Discussion

Configuring the application to implement organizationwide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoW that reflects the most restrictive security posture consistent with operational requirements. If Instant Clones are used within the Horizon environment, an Active Directory User Account must be created that will be used to manage cloned Computer objects in Active Directory. Following least privilege best practices, this User Account must only be able to perform operations on Computer objects within a specified container in Active Directory.

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Domains.

3. In the right pane, click the "Domain Accounts" tab.

4. Validate the accounts listed are User accounts in Active Directory and have only the following permissions on the specified Instant Clone container:

List Contents
Read All Properties
Write All Properties
Read Permissions
Reset Password
Create Computer Objects
Delete Computer Objects

5. Verify the permissions apply to the correct container and to all child objects of the container.

If the Instant Clone domain account has more than the minimum required permissions, this is a finding.

If Instant Clones are not used, this is not applicable.