Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-246862 | HRZA-7X-000003 | SV-246862r768546_rule | Medium |
Description |
---|
The Horizon Agent has the capability to run scripts on user connect, disconnect, and reconnect. While this can be useful in setting up a user environment, in certain circumstances, the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should site require this setting, ensure it is audited and its configuration valid at all times. |
STIG | Date |
---|---|
VMware Horizon 7.13 Agent Security Technical Implementation Guide | 2021-07-30 |
Check Text ( C-50294r768544_chk ) |
---|
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnDisconnect" setting. If "CommandsToRunOnDisconnect" is "Not Configured" or "Disabled", this is not a finding. Click the "Show..." button next to "Commands". If any of the listed commands are not expected, approved, and required, this is a finding. |
Fix Text (F-50248r768545_fix) |
---|
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnDisconnect" setting. Option 1: Click the radio button next to "Disabled". Click "OK". Option 2: Click the "Show..." button next to "Commands". Highlight the unneeded command and press the "delete" key. Click "OK". Click "OK". |