A method, implemented on a server in a virtual desktop infrastructure environment, for isolating a biometric device to a user session, the method comprising: in response to an application that is executing in a user session requesting enumeration of biometric devices that are connected to the server, intercepting, by a hooking component, an enumeration response that includes an identifier of a biometric device; extracting the identifier of the biometric device from the enumeration response and sending the identifier to a filter driver; employing, by the filter driver, the identifier of the biometric device to obtain a session ID of a user session to which the biometric device is redirected and returning the session ID to the hooking component; and comparing, by the hooking component, the session ID received from the filter driver to a session ID of the user session in which the application is executing such that: when the hooking component determines that the session ID received from the filter driver does not match the session ID of the user session in which the application is executing, the hooking component removes the identifier of the biometric device from the enumeration response prior to allowing the enumeration response to be provided to the application, whereas when the hooking component determines that the session ID received from the filter driver matches the session ID of the user session in which the application is executing, the hooking component allows the enumeration response to be provided to the application without removing the identifier of the biometric device. in response to an application that is executing in a user session requesting enumeration of biometric devices that are connected to the server, intercepting, by a hooking component, an enumeration response that includes an identifier of a biometric device; extracting the identifier of the biometric device from the enumeration response and sending the identifier to a filter driver; employing, by the filter driver, the identifier of the biometric device to obtain a session ID of a user session to which the biometric device is redirected and returning the session ID to the hooking component; and comparing, by the hooking component, the session ID received from the filter driver to a session ID of the user session in which the application is executing such that: when the hooking component determines that the session ID received from the filter driver does not match the session ID of the user session in which the application is executing, the hooking component removes the identifier of the biometric device from the enumeration response prior to allowing the enumeration response to be provided to the application, whereas when the hooking component determines that the session ID received from the filter driver matches the session ID of the user session in which the application is executing, the hooking component allows the enumeration response to be provided to the application without removing the identifier of the biometric device. when the hooking component determines that the session ID received from the filter driver does not match the session ID of the user session in which the application is executing, the hooking component removes the identifier of the biometric device from the enumeration response prior to allowing the enumeration response to be provided to the application, whereas when the hooking component determines that the session ID received from the filter driver matches the session ID of the user session in which the application is executing, the hooking component allows the enumeration response to be provided to the application without removing the identifier of the biometric device.