UCF STIG Viewer Logo

The Horizon Agent must only run allowed scripts on user reconnect.


Overview

Finding ID Version Rule ID IA Controls Severity
V-246863 HRZA-7X-000004 SV-246863r768549_rule Medium
Description
The Horizon Agent has the capability to run scripts on user connect, disconnect, and reconnect. While this can be useful in setting up a user environment, in certain circumstances, the running of such scripts should be delegated to native windows capabilities where possible. These settings are powerful and can serve as a potential space for a privileged attacker to persist. By default, this setting is unconfigured. Should a site require this setting, ensure it is audited and the configuration valid at all times.
STIG Date
VMware Horizon 7.13 Agent Security Technical Implementation Guide 2021-07-30

Details

Check Text ( C-50295r768547_chk )
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnReconnect" setting.

If "CommandsToRunOnReconnect" is "Not Configured" or "Disabled", this is not a finding.

Click the "Show..." button next to "Commands". If any of the listed commands are not expected, approved, and required, this is a finding.
Fix Text (F-50249r768548_fix)
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "CommandsToRunOnReconnect" setting.

Option 1:

Click the radio button next to "Disabled". Click "OK".

Option 2:

Click the "Show..." button next to "Commands". Highlight the unneeded command and press the "delete" key. Click "OK". Click "OK".