← Back to Omnissa Horizon Agent Security Technical Implementation Guide

V-286845

CAT II (Medium)

The Horizon Agent must validate the entire issuance chain of certificates.

Rule ID

SV-286845r1288300_rule

STIG

Omnissa Horizon Agent Security Technical Implementation Guide

Version

V1R1

CCIs

CCI-000185

Discussion

The Horizon Agent validates certificate issuance chains up to, but not including the root certificate authority (CA) by default. This behavior must be changed to validate the entire chain, including root.

Check Content

Verify the "hzn_common.admx" template has been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Common Configuration >> Security Configuration.

Double-click the "Type of certificate revocation check" setting.

If "Type of certificate revocation check" is not set to "Enabled", this is a finding.

In the drop-down menu below "Type of certificate revocation check", if "WholeChain" is not selected, this is a finding.

Fix Text

Verify the "hzn_common.admx" template has been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Common Configuration >> Security Configuration.

Double-click the "Type of certificate revocation check" setting.

Verify "Type of certificate revocation check" is set to "Enabled".

In the drop-down menu below "Type of certificate revocation check", select "WholeChain".

Click "OK".