← Back to Omnissa Horizon Agent Security Technical Implementation Guide

V-286834

CAT II (Medium)

The Horizon Agent must disable access to a virtual desktop infrastructure (VDI) PC-over-IP (PCoIP) session from a vSphere console.

Rule ID

SV-286834r1288267_rule

STIG

Omnissa Horizon Agent Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000366

Discussion

Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to be viewed by authorized individuals. By default, the Horizon Agent does not allow access to a PCoIP session from a vSphere console. This configuration option must be validated and maintained over time. Note: This control applies to VDI PCoIP sessions, and not RDSH sessions.

Check Content

Verify the "pcoip.admx" template has been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> PCoIP Session Variables >> Not Overridable Administrator Settings.

If "Enable access to a PCoIP session from a vSphere console" is set to "Enabled", this is a finding.

Fix Text

Verify the "pcoip.admx" template has been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> PCoIP Session Variables >> Not Overridable Administrator Settings.

Double-click the "Enable access to a PCoIP session from a vSphere console" setting.

Verify "Enable access to a PCoIP session from a vSphere console" is set to "Disabled".

Click "OK".