Rule ID
SV-286837r1288276_rule
Version
V1R1
CCIs
Data loss prevention is a primary concern for the DoW. Positive control of data must be maintained at all times, and data must only be allowed to flow over channels that are provided for that explicit purpose and are monitored appropriately. By default, the Horizon Client, Agent, and guest operating systems will coordinate to allow drives local to the client to be redirected over the Client connection and mounted in the virtual desktop. This configuration must be modified to disallow drive sharing to protect sensitive DoW data from being maliciously, accidentally, or casually removed from the controlled environment.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection. Double-click the "Do not allow drive redirection" setting. If "Do not allow drive redirection" is not set to "Enabled", this is a finding.
Verify the "vdm_agent*.admx" templates have been added to the Active Directory Domain. Open the "Group Policy Management" MMC snap-in, then open the applicable GPO that is applying the Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> Windows Components >> Remote Desktop Services >> Remote Desktop Session Host >> Device and Resource Redirection. Double-click the "Do not allow drive redirection" setting. Verify "Do not allow drive redirection" is set to "Enabled". Click "OK".