V-287320

Discussion

Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Client, Agent, and guest operating systems will coordinate to allow printers local to the client to be redirected over the Client connection and made available in the virtual desktop. This configuration must be modified to disallow printer redirection to protect sensitive data from being maliciously, accidentally, or casually printed from the controlled environment.

Check Content

Printer redirection can be disabled in a number of ways:

1. The desktop OS.
2. A third-party DLP solution.
3. The "Omnissa Integrated Printing" optional Horizon Agent feature not being selected during install on any VDI image.

If any of these methods are already employed, the risk is already addressed and this is not a finding.

If printer redirection is not otherwise blocked, the Horizon Client must be configured to block printer redirection.

Verify the "vdm_client*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon Client settings to the desktop machines.

Navigate to Computer Configuration >> Administrative Templates >> Omnissa Horizon Client Configuration >> Omnissa Integrated Printing.

If "Do not redirect client printer(s)" is not set to "Enabled", this is a finding.