The Horizon Connection Server must disconnect applications after two hours of idle time.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246900	HRZV-7X-000019	SV-246900r768660_rule		Medium

Description
Horizon View is intended to provide remote desktops and applications during for more or less continuous use. If an application is open and goes used for more than two hours, that application must be closed to eliminate the risk of that idle application being usurped. For desktops, sessions will not be disconnected after two hours but the credentials stored with Horizon will be invalidated. Subsequent desktop connection attempts will require reauthentication.

Description

Horizon View is intended to provide remote desktops and applications during for more or less continuous use. If an application is open and goes used for more than two hours, that application must be closed to eliminate the risk of that idle application being usurped. For desktops, sessions will not be disconnected after two hours but the credentials stored with Horizon will be invalidated. Subsequent desktop connection attempts will require reauthentication.

STIG	Date
VMware Horizon 7.13 Connection Server Security Technical Implementation Guide	2021-07-30

Details

Check Text ( C-50332r768658_chk )
Log in to the Horizon 7 Console. From the left pane, navigate to Settings >> Global Settings. In the right pane, click the "General Settings" tab. Locate the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting. If the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting is set to "Never", this is a finding. If the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting is set to greater than "120" minutes (two hours), this is a finding.

Check Text ( C-50332r768658_chk )

Log in to the Horizon 7 Console. From the left pane, navigate to Settings >> Global Settings. In the right pane, click the "General Settings" tab. Locate the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting.

If the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting is set to "Never", this is a finding.

If the "Disconnect Applications and Discard SSO Credentials for Idle Users" setting is set to greater than "120" minutes (two hours), this is a finding.

Fix Text (F-50286r768659_fix)
Log in to the Horizon 7 Console. From the left pane, navigate to Settings >> Global Settings. In the right pane, click the "General Settings" tab. Click "Edit". Next to "Disconnect Applications and Discard SSO Credentials for Idle Users", select "After" from the dropdown and fill in "120" minutes in the text field. Click "OK".