Last updated:
Microsoft has released the new Security Baseline for Microsoft Edge 151.
Normally, that initially sounds like:
New version → new ADMX → update baseline → done.
This time, however, I would look more closely in Citrix and RDS environments.
Microsoft includes several new recommendations. One is particularly interesting:
👉 Process Isolation
What is behind it?
Process Isolation aims to prevent other local processes from interfering with Microsoft Edge or manipulating browser processes.
Entirely understandable from a security perspective.
However, enterprise environments have plenty of software that operates exactly at this point.
For example:
DLP / endpoint security / SSO / monitoring / browser integrations / legacy agents
And this is where it becomes interesting for Citrix.
On a normal client, it affects one user.
On a multi-session VDA with 30, 50 or more users, a small browser baseline change may suddenly affect many sessions simultaneously.
A typical scenario
New Edge ADMX files are added to the Central Store.
The new Security Baseline is applied to the Citrix VDAs.
Edge starts.
Websites work.
Test successful?
Not necessarily. 😉
The interesting part is the integrations:
👉 Does SSO still work?
👉 Do DLP/security components work?
👉 Do browser extensions work?
👉 Do internal web applications work?
👉 Are there sudden errors or unusual processes?
Another point: Automatic HTTPS
Microsoft also recommends evaluating Automatic HTTPS.
That initially sounds sensible too.
However, anyone still running internal applications accessible only through HTTP should be cautious with aggressive upgrade modes.
Experience shows that older Citrix environments still contain quite a few of these. 😎
My recommendation
A new browser Security Baseline should not go straight into the production golden image.
First:
Baseline diff → test VDA → security/SSO/DLP → internal web apps → multi-session test → production
And if Process Isolation causes problems:
Do not simply disable the policy again.
First determine which software is trying to interfere with the browser process.
That may be the actual finding.
Takeaway
Security Baselines are not collections of settings to simply switch to Enabled.
Especially on Citrix multi-session VDAs, small browser changes can have a substantial impact.
Hardening without compatibility testing is another way to prepare for future troubleshooting. 😉
