Rule ID
SV-286835r1288270_rule
Version
V1R1
CCIs
Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to be viewed by authorized individuals. By default, the Horizon Agent will display a blank screen for an active session when accessed through the VM console, but allows for mirroring the Blast screen to the VM console. This configuration option must be disabled, validated and maintained over time. Note: This control applies to VDI Blast sessions, and not RDSH sessions.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Blast. If "Screen Blanking" is set to "Disabled" or "Not Configured", this is a finding.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Horizon Blast. Double-click the "Screen Blanking" setting. Verify "Screen Blanking" is set to "Enabled". Click "OK".