V-286844

Discussion

The Horizon Agent has the capability to run scripts when a user connects, disconnects, or reconnects. While this can be useful in setting up a user environment, in certain circumstances the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should the site require this setting, ensure it is audited and its configuration valid at all times.

Check Content

Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration >> TrueSSO Configuration.

Double-click the "Disable TrueSSO" setting.

If "Disable TrueSSO" is set to either "Not Configured" or "Disabled", this is a finding.