User manual

Table 3‑5. Horizon Client Configuration Template: Security Settings (Continued)
Setting Description
Configures SSL protocols and
cryptographic algorithms
(Computer and User Configuration
setting)
Configures the cipher list to restrict the use of certain cryptographic algorithms
and protocols before establishing an encrypted SSL connection. The cipher list
consists of one or more cipher strings separated by colons.
NOTE The cipher string is case-sensitive.
The default value is TLSv1:TLSv1.1:TLSv1.2:!aNULL:kECDH+AES:ECDH
+AES:RSA+AES:@STRENGTH.
That means that TLS v1, TLS v1.1 and TLS v1.2 are enabled. (SSL v2.0 and v3.0
are removed.)
Cipher suites use 128- or 256-bit AES, remove anonymous DH algorithms, and
then sort the current cipher list in order of encryption algorithm key length.
Reference link for the configuration:
http://www.openssl.org/docs/apps/ciphers.html
The equivalent Windows Registry value is SSLCipherList.
Enable Single Sign-On for
smart card authentication
(Computer Configuration setting)
Determines whether single sign-on is enabled for smart card authentication.
When single sign-on is enabled, Horizon Client stores the encrypted smart card
PIN in temporary memory before submitting it to View Connection Server.
When single sign-on is disabled, Horizon Client does not display a custom PIN
dialog.
The equivalent Windows Registry value is EnableSmartCardSSO.
Ignore bad SSL certificate
date received from the server
(Computer Configuration setting)
(View 4.6 and earlier releases only) Determines whether errors that are
associated with invalid server certificate dates are ignored. These errors occur
when a server sends a certificate with a date that has passed.
The equivalent Windows Registry value is IgnoreCertDateInvalid.
Ignore certificate revocation
problems
(Computer Configuration setting)
(View 4.6 and earlier releases only) Determines whether errors that are
associated with a revoked server certificate are ignored. These errors occur
when the server sends a certificate that has been revoked and when the client
cannot verify a certificate's revocation status.
This setting is disabled by default.
The equivalent Windows Registry value is IgnoreRevocation.
Ignore incorrect SSL
certificate common name (host
name field)
(Computer Configuration setting)
(View 4.6 and earlier releases only) Determines whether errors that are
associated with incorrect server certificate common names are ignored. These
errors occur when the common name on the certificate does not match the
hostname of the server that sends it.
The equivalent Windows Registry value is IgnoreCertCnInvalid.
Ignore incorrect usage
problems
(Computer Configuration setting)
(View 4.6 and earlier releases only) Determines whether errors that are
associated with incorrect usage of a server certificate are ignored. These errors
occur when the server sends a certificate that is intended for a purpose other
than verifying the identity of the sender and encrypting server communications.
The equivalent Windows Registry value is IgnoreWrongUsage.
Ignore unknown certificate
authority problems
(Computer Configuration setting)
(View 4.6 and earlier releases only) Determines whether errors that are
associated with an unknown Certificate Authority (CA) on the server certificate
are ignored. These errors occur when the server sends a certificate that is signed
by an untrusted third-party CA.
The equivalent Windows Registry value is IgnoreUnknownCa.
RDP Settings for Client GPOs
You can set group policies for options such as redirection of such things as audio, printers, ports, and other
devices when you use the Microsoft RDP display protocol.
The following table describes the Remote Desktop Protocol (RDP) settings in the Horizon Client
Configuration ADM template file. All RDP settings are User Configuration settings.
Chapter 3 Configuring Horizon Client for End Users
VMware, Inc. 45