V-286829

Discussion

Idle sessions present an increased risk of being hijacked. If a user steps away from their desk and is no longer in positive control of their session, that session is in danger of being assumed by another user. Idle sessions can also waste valuable datacenter resources, which in turn may lead to a lack of resources for new, active users. An organizationally defined idle timeout value must be configured to override the Horizon default value of "never". Satisfies: SRG-APP-000003, SRG-APP-000190

Check Content

Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> Omnissa Horizon Agent Configuration >> Agent Configuration.

Double-click the "Idle Time Until Disconnect (VDI)" setting.

If "Idle Time Until Disconnect (VDI)" is set to either "Not Configured" or "Disabled", this is a finding.

In the drop-down menu next to "Idle Timeout", if "Never" is selected, this is a finding.

Double-click the "RDS Idle Time Until Disconnect" setting.

If "RDS Idle Time Until Disconnect" is set to either "Not Configured" or "Disabled", this is a finding.

In the drop-down menu next to "RDS Idle Timeout", if "Never" is selected, this is a finding.