The Horizon Agent must set an idle timeout.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246865	HRZA-7X-000006	SV-246865r768555_rule		Medium

Description
Idle sessions are at increased risk of being hijacked. If a user has stepped away from their desk and is no long in positive control of their session, that session is in danger of being assumed by an attacker. Idle sessions also waste valuable datacenter resources and could potentially lead to a lack of resources for new, active users. As such, an organizationally defined idle timeout must be supplied to override the Horizon default of "never".

Description

Idle sessions are at increased risk of being hijacked. If a user has stepped away from their desk and is no long in positive control of their session, that session is in danger of being assumed by an attacker. Idle sessions also waste valuable datacenter resources and could potentially lead to a lack of resources for new, active users. As such, an organizationally defined idle timeout must be supplied to override the Horizon default of "never".

STIG	Date
VMware Horizon 7.13 Agent Security Technical Implementation Guide	2021-07-30

Details

Check Text ( C-50297r768553_chk )
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting. If "Idle Time Until Disconnect (VDI)" is "Not Configured" or "Disabled", this is a finding. In the drop-down next to "Idle Timeout", if "Never" is selected, this is a finding.

Check Text ( C-50297r768553_chk )

Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting.

If "Idle Time Until Disconnect (VDI)" is "Not Configured" or "Disabled", this is a finding.

In the drop-down next to "Idle Timeout", if "Never" is selected, this is a finding.

Fix Text (F-50251r768554_fix)
Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts. Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting. Click the radio button next to "Enabled". In the drop-down next to "Idle Timeout", select an appropriate, site-specific timeout that is not "Never". This is typically two hours but your configuration may vary. Click "OK".

Fix Text (F-50251r768554_fix)

Ensure the vdm_agent*.admx templates are added. Open the "Group Policy Management" MMC snap-in. Open the site-specific GPO applying Horizon settings to the VDI desktops or RDS hosts.

Navigate to Computer Configuration >> Policies >> Administrative Templates >> VMware View Agent Configuration >> Agent Configuration. Double-click the "Idle Time Until Disconnect (VDI)" setting.

Click the radio button next to "Enabled".

In the drop-down next to "Idle Timeout", select an appropriate, site-specific timeout that is not "Never". This is typically two hours but your configuration may vary. Click "OK".