Rule ID
SV-286832r1289267_rule
Version
V1R1
CCIs
Disconnected sessions present an increased risk of being hijacked. If a user steps away from their desk, that disconnected session is in danger of being reinstantiated by another user. Disconnected sessions can also waste valuable datacenter resources, which may lead to a lack of resources for new, active users. An organizationally defined disconnected RDS session timeout value must be configured to override the default value of "never".
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Disconnected Time Until Logoff" setting. If "RDS Disconnected Time Until Logoff" is set to either "Not Configured" or "Disabled", this is a finding. In the drop-down menu next to "RDS Disconnect Timeout", if "Never" is selected, this is a finding.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration. Double-click the "RDS Disconnected Time Until Logoff" setting. Verify "RDS Disconnected Time Until Logoff" is set to "Enabled". In the drop-down menu next to "RDS Disconnect Timeout", select an appropriate, site-specific timeout value that is not "Never". Click "OK".