We have deployed StoreFront unauthenticated store for a use case. Local drives and network drives are getting redirected for anonymous user, could see the setting under HLKM:\Software\Policies\Citrix so it is coming from ICA policies but can’t see unauthenticated user sessions in Director to see which policy is getting applied. Is there a way to lock down anonymous user sessions?

Set the default policy to not map drives, then create a policy for Domain Users to map drives. Anonymous accounts are local accounts on the machines, and not part of the domain so they won't get those permissions.

Unfiltered default policy is disabled in our environment. However, some policies to all users and computers without any filter. I will target those and see if that is the cause.

the default is to map drives

Yes, but from where that is applied. I have disabled unfiltered policy and made sure domain users filter is added to client drive mapping policy.

The unfiltered policy is not what turns on default values. Those are built into the system itself. You need to create a new base policy that by default disables the drive maps, then have a higher policy that enables it for domain users.

I figured it. Installed Citrix Group Policy management on the VDA, modified unfiltered policy on the VDA locally and that did the trick. Now I will disable Unfiltered policy on the VDA and try to create a new one with local Anonymous group as filter.

I would just do it globally to be honest. Easier way to control it without modifying images directly.