V-286836

Discussion

The Horizon Agent has the capability to granularly control what, if any, USB devices are allowed to be passed from the local client to the agent on the virtual desktop. By default, Horizon blocks certain device families from being redirected to the remote desktop or application. While there are legitimate reasons to pass USB devices to the desktop, these must be carefully analyzed for necessity. At a minimum, USB Mass Storage devices must never be passed through, in keeping with DoW data loss prevention policies. As thumb drives are disallowed for physical PCs, so should they be for virtual desktops. This can be accomplished in several ways, including natively in the Horizon Agent.

Check Content

USB mass storage devices can be blocked in a number of ways:

1. The desktop OS.
2. A third party DLP solution.
3. The "USB Redirection" optional Horizon Agent feature not being selected during install on any VDI image.
4. On the Connection Server via individual pool policies or global policies.

If any of these methods are already employed, the risk is already addressed and this requirement is not applicable.

If USB devices are not otherwise blocked, the Horizon Agent must be configured to block storage devices.

Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain.

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Horizon USB Configuration.

Option 1: Allow all, deny by exception.

Verify "Exclude All Devices" is set to "Not Configured" or "Disabled".

If "Exclude Device Family" is not set to "Enabled" with the value "o:storage" included, this is a finding.

Option 2: Deny all, allow by exception.

Verify "Exclude All Devices" is set to "Enabled".

If "Include Device Family" is set to "Enabled" and includes the value "storage", this is a finding.

If either option above is true, this is a finding.