Windows – Auto logout rdp sessions

group-policywindowswindows-server-2012-r2

I have a need to logout certain rdp sessions (superadmin account) after 15 minutes of inactivity. if someone forgets to disconnect a session from one of the windows servers and a password changes overnight, it wont lock the account. I have found a group policy setting for this (end a disconnected session in remote desktop services) but i only want to apply it to the super admin account, is this possible by just adding the super admin to the gp permission.

Best Answer

You describe the condition as if someone forgets to disconnect a session and you are applying End a disconnected session setting on your Remote Desktop Services Sessions. First you need to understand the difference between two settings:

End a disconnected session

Specify the maximum amount of time that a disconnected user session is kept active on the RD Session Host server. If you specify "Never," the user's disconnected session is maintained for an unlimited time. When a session is in a disconnected state, running programs are kept active even though the user is no longer actively connected.

Idle session limit

Specify the maximum amount of time that an active Remote Desktop Services session can be idle (without user input) before the session is automatically disconnected or ended. The user receives a warning two minutes before the session is disconnected or ended, which allows the user to press a key or move the mouse to keep the session active.

It sounds like you need the latter, instead.

Both of these setting can be set in Computer Configuration or User Configuration. As you want to apply this only on specific user(s), you need to use the settings on User Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits.

As always, you can apply a GPO only to specific users if they are on a separate OU container.

Related Solutions

Use group policy to force certain security groups to log off remote desktop sessions

A couple of things:

Computer Configuration settings apply to computers, not users. That's why you needed to add the Domain Computers group to the GPO security filtering... because Computer Configuration settings apply to computers... so the GPO can only affect Computers that are in the OU where the GPO is linked and are in the security group being used as a security filter. As such, the settings will apply to every user that logs onto a computer in the OU where the GPO is linked... because those are Computer Configuration settings.
You can't apply Group Policy directly to a group. Group Policies apply to computers and/or users. You can use a group to filter the GPO so that it is only applied to the members of the security group (users or computers).
If you want to apply those settings to only a subset of your users then configure those settings under User Configuration... then link the GPO to the OU where your user accounts are... and use Security Filtering to apply the GPO to the subset of users who are members of the security group.

Bypassing GPO for “set time limit for disconnected sessions”

I used to work in an environment that mandated a one minute disconnected session limit. It drove me crazy. I can't tell you how many times an install or config was killed in the middle when I lost my connection to the server. I did however eventually find a workaround. Change the following registry value as shown:

Key:   HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
Value: MaxDisconnectionTime
Type:  DWORD
Data:  0

This is the value set by the policy "Set time limit for disconnected sessions". It's stored as a millisecond value. If you set it to zero before connecting to the server, your session will not be disconnected. You'll need to change it back when you are done, though. Also keep in mind that this generally requires you to have local administative rights on the subject server but it sounds like you ARE the admin there.

Best Answer

Related Solutions

Use group policy to force certain security groups to log off remote desktop sessions

Bypassing GPO for “set time limit for disconnected sessions”

Related Topic