Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

Citrix XenDesktop 7.x Delivery Controller Security Technical Implementation Guide

V1R4 · · · Released 02 Jul 2025 · 5 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Supporting documents DISA companion ZIP · 1.5 MB 3 PDFs

Bundled by DISA alongside this STIG release: overview, revision history, and readme files. Download the full archive or open an individual PDF.

Download full ZIP U_Citrix_XenDesktop_7-x_Y25M07_STIG.zip
Digest of Updates vs. V1R3 · 24 Apr 2020 +5 −4

Comparison against the immediately-prior release (V1R3). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 5

  • V-213195 Medium Delivery Controller must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
  • V-213196 Medium Delivery Controller must be configured to disable non-essential capabilities.
  • V-213197 High Delivery Controller must implement NIST FIPS-validated cryptography for the following: to provision digital signatures; to generate cryptographic hashes; and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-213198 Medium Delivery Controller must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
  • V-275973 High The version of XenDesktop Delivery Controller running on the system must be a supported version.

Removed rules 4

  • V-81403 Medium Delivery Controller must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
  • V-81407 Medium Delivery Controller must be configured to disable non-essential capabilities.
  • V-81409 High Delivery Controller must implement NIST FIPS-validated cryptography for the following: to provision digital signatures; to generate cryptographic hashes; and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
  • V-81411 Medium Delivery Controller must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
Sort by
b
Delivery Controller must limit the number of concurrent sessions to an organization-defined number for all accounts and/or account types.
AC-10 - Medium - CCI-000054 - V-213195 - SV-213195r960735_rule
RMF Control
AC-10
Severity
M
CCI
CCI-000054
Version
CXEN-DC-000005
Vuln IDs
  • V-213195
  • V-81403
Rule IDs
  • SV-213195r960735_rule
  • SV-96117
Application management includes the ability to control the number of users and user sessions that utilize an application. Limiting the number of allowed users and sessions per user is helpful in limiting risks related to Denial-of-Service (DoS) attacks. This requirement may be met via the application or by using information system session control provided by a web server with specialized session management capabilities. If it has been specified that this requirement will be handled by the application, the capability to limit the maximum number of concurrent single user sessions must be designed and built into the application. This requirement addresses concurrent sessions for information system accounts and does not address concurrent sessions by single users via multiple system accounts. The maximum number of concurrent sessions should be defined based on mission needs and the operational environment for each system.
Checks: C-14429r288882_chk

Open Citrix Studio, right-click a Delivery Group, and choose "Edit Delivery Group". Verify the following check box is not checked: "Give access to unauthenticated (anonymous) users; no credentials are required to access StoreFront". If the check box is checked, this is a finding. A Citrix Studio administrator account is needed to perform this check. Performing this check does not impact system reliability or availability.

Fix: F-14427r288883_fix

Open Citrix Studio, right-click a Delivery Group, and choose "Edit Delivery Group". Uncheck the following check box: "Give access to unauthenticated (anonymous) users; no credentials are required to access StoreFront". A Citrix Studio administrator account is needed to perform above fix.

b
Delivery Controller must be configured to disable non-essential capabilities.
CM-7 - Medium - CCI-000381 - V-213196 - SV-213196r960963_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
CXEN-DC-000270
Vuln IDs
  • V-213196
  • V-81407
Rule IDs
  • SV-213196r960963_rule
  • SV-96121
It is detrimental for applications to provide or install by default functionality exceeding requirements or mission objectives. These unnecessary capabilities or services are often overlooked and therefore may remain unsecured. They increase the risk to the platform by providing additional attack vectors. Applications are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations (e.g., key missions, functions). Examples of non-essential capabilities include but are not limited to advertising software or browser plug-ins not related to requirements or providing a wide array of functionality not required for every mission but that cannot be disabled.
Checks: C-14430r288885_chk

Verify Citrix Customer Experience Improvement Program (CEIP) - PHONE HOME is disabled on XenDesktop Delivery Controller. 1. Launch Studio. 2. Select "Configuration" in the left navigation pane. 3. Select the Support tab. 4. Verify CEIP is disabled. If CEIP is not disabled, this is a finding.

Fix: F-14428r288886_fix

To disable Citrix CEIP - Phone Home: 1. Launch Studio. 2. Select "Configuration" in the left navigation pane. 3. Select the Support tab. 4. Follow the prompts to end participation in CEIP. This prevents automatic upload of installation experience metrics that are collected locally during installation. XenDesktopServerStartup.exe /components "CONTROLLER,DESKTOPSTUDIO" /disableexperiencemetrics /exclude "Smart Tools Agent" /nosql /quiet /verboselog /noreboot

c
Delivery Controller must implement NIST FIPS-validated cryptography for the following: to provision digital signatures; to generate cryptographic hashes; and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards.
SC-13 - High - CCI-002450 - V-213197 - SV-213197r1115916_rule
RMF Control
SC-13
Severity
H
CCI
CCI-002450
Version
CXEN-DC-001225
Vuln IDs
  • V-213197
  • V-81409
Rule IDs
  • SV-213197r1115916_rule
  • SV-96123
Use of weak or untested encryption algorithms undermines the purposes of using encryption to protect data. The application must implement cryptographic modules adhering to the higher standards approved by the Federal Government since this provides assurance they have been tested and validated.
Checks: C-14431r1115914_chk

Enforcement is via FIPS encryption. To verify, open the Registry Editor on the XenDesktop Delivery Controller and find the following key name: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\DesktopServer 1. Verify that the XmlServicesSslPort registry key exists with the correct value for SSL port. By default, it is set to "443". 2. Verify XmlServicesEnableNonSsl is set to "0". 3. Verify the corresponding registry value to ignore HTTPS traffic, XmlServicesEnableSsl, is not set to "0". If "XmlServicesSslPort" is not set to the desired port, this is a finding. If "XmlServicesEnableNonSsl" is not set to "0", this is a finding. If XmlServicesEnableSsl is not set to "1", this is a finding. To verify the FIPS Cipher Suites used: 1. From the Group Policy Management Console, go to Computer Configuration >> Administrative Templates >> Networks >> SSL Configuration Settings. 2. Double-click "SSL Cipher Suite Order" and verify the "Enabled" option is checked. 3. Verify the correct Cipher Suites are listed in the correct order per current DOD guidelines. If the "Enabled" option is not checked or the correct Cipher Suites are not listed in the correct order per current DOD guidelines, this is a finding.

Fix: F-14429r1115915_fix

Obtain and install root certificate(s) for server certificates installed on Desktop/Server VDAs, SQL Server(s), Storefront, and VM Host (VMware VCenter, Hyper-V, XenServer). To install a TLS server certificate on the Delivery Controller and to configure a port with TLS 1.x: 1. Log on to the Delivery Controller server with a domain account that has Administrator rights. 2. Obtain a TLS server certificate and install it on the Delivery Controller using Microsoft server instructions. 3. Configure the Delivery Controller with the certificate. When the Server Certificate is installed on IIS, set the Bindings to enable HTTPS on IIS by completing the following procedure: 1. Select the IIS site that you want to enable HTTPS and select "Bindings" under "Edit Site". 2. Click "Add", select "Type" as https and port number as "443". Select the SSL Certificate that was installed and click "OK". 3. Open the Registry Editor on the XenDesktop Controller and find the following key name: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\DesktopServer 4. Verify that XmlServicesSslPort registry key exists with the correct value for SSL port. By default, it is set to "443". 5. Change the XML service port using PowerShell or by running the following command: BrokerService –WiSslPort <port number> Notes: a) If you decide to change the XML service port number on the XenDesktop controller, update the IIS port number as well under "Bindings" to match the new value. b) On XenDesktop 7.11, the parameter of brokerservice.exe has changed from "wisslport" to "storefronttlsport". The brokerservice.exe is found in c:\program files\citrix\broker\service. A reboot of the Delivery Controller is needed for this to take effect. To change the default VDA registration port: 1. Log on to the Delivery Controller server with a domain account that has Administrator rights. 2. Open the command prompt window and type these commands: %SystemDrive% Cd %ProgramFiles%\Citrix\Broker\Service BrokerService.exe –VDAport 8888 3. Launch Server Manager from the Start menu. 4. In the Server Manager, go to the "Local Server" properties window and edit the "Windows Firewall" setting. Click "Advanced Settings". 5. Click "Inbound Rules". 6. Create a new inbound rule with the following settings: a) In the Rule type screen, click "Port". Click "Next". b) In the Protocol and Ports screen, select "Specific local ports" and type "8888". Click "Next". c) In the Action screen, accept the default value "Allow the connection" and click "Next". d) In the Profile screen, accept the default values and click "Next". e) In the Name screen, type a name for the rule (example: Citrix VDA Registration Port) and click "Finish". For correct Cipher Suite order per DOD guidance: Apply the following to Computers OU containing XenDesktop infrastructure: - XD2017 CC - Computer - SSL Ciphersuite Order To configure the SSL Cipher Suite Order Group Policy setting manually, follow these steps: 1. At a command prompt, enter "gpedit.msc", and press "Enter". The Local Group Policy Editor is displayed. 2. Go to Computer Configuration >> Administrative Templates >> Network >> SSL Configuration Settings. 3. Under SSL Configuration Settings, select "SSL Cipher Suite Order". 4. In the SSL Cipher Suite Order pane, scroll to the bottom. Follow the instructions that are labeled "How to modify this setting".

b
Delivery Controller must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs.
CM-6 - Medium - CCI-000366 - V-213198 - SV-213198r961863_rule
RMF Control
CM-6
Severity
M
CCI
CCI-000366
Version
CXEN-DC-001235
Vuln IDs
  • V-213198
  • V-81411
Rule IDs
  • SV-213198r961863_rule
  • SV-96125
Configuring the application to implement organization-wide security implementation guides and security checklists ensures compliance with federal standards and establishes a common security baseline across DoD that reflects the most restrictive security posture consistent with operational requirements. Configuration settings are the set of parameters that can be changed that affects the security posture and/or functionality of the system. Security-related parameters are parameters impacting the security state of the application, including the parameters required to satisfy other security control requirements.
Checks: C-14432r288891_chk

To verify that XenDesktop Controller and all other infrastructure server components are installable and manageable by authorized administrative accounts, the following policies must be modified: Go to Computer Configuration Policies &gt;&gt; Windows Settings &gt;&gt; Security Settings &gt;&gt; Local Policies/User Rights Assignment. Verify policy settings "Allow log on locally" and "Shut down the system" are both set to the global security group name containing the XenApp or XenDesktop administrators. "Local Administrators" may remain. If they are not set to the global security group name containing the XenApp or XenDesktop administrators, this is a finding.

Fix: F-14430r288892_fix

To ensure that XenDesktop Controller and all other infrastructure server components are installable and manageable by authorized administrative accounts, the following policies must be modified: Go to Computer Configuration Policies >> Windows Settings >> Security Settings >> Local Policies/User Rights Assignment. 1. Edit "Allow log on locally". 2. Edit "Shut down the system". 3. Change both settings to the global security group name containing the XenApp or XenDesktop administrators. "Local Administrators" may remain.

c
The version of XenDesktop Delivery Controller running on the system must be a supported version.
SI-2 - High - CCI-002605 - V-275973 - SV-275973r1115917_rule
RMF Control
SI-2
Severity
H
CCI
CCI-002605
Version
CXEN-DC-999999
Vuln IDs
  • V-275973
Rule IDs
  • SV-275973r1115917_rule
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions that are used to install patches across the enclave and also to applications that are not part of that patch management solution. For example, many browsers provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may depend on the Information Assurance Vulnerability Management (IAVM) process. The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
Checks: C-80091r1111776_chk

XenDesktop Delivery Controller 7.x is no longer supported by the vendor. If the system is running XenDesktop Delivery Controller 7.x, this is a finding.

Fix: F-79996r1111777_fix

Upgrade to a supported version.