Idle time out GPO for Remote Desktop Services sessions not working in Windows 2019 servers

[kpr208]

I have configured GPO to Set time limit for active but idle Remote Desktop Services sessions. Policy has been set to disconnect sessions which are idle for more than 3 hours. But I am getting warning after 30 minutes itself. This GPO has been applied at OU level. Issue occurs only with Windows 2019 servers. Session time limits on Windows 2016 servers which are in the same OU works well. I ran gpresult /h on the affected servers. I could see session time limit policy is applied properly still sessions are getting disconnected after 30 minutes.

Anyone came across this issue? Please assist me

[#2]

@kpr208 

Hello kpr208,

If you face a session time-limit policy issue that gets disconnected after the meantime. You can follow the steps below in order to fix the issue,

By default, the user’s RDP session in Windows may stay disconnected until the user or administrator terminates, or the computer is restarted. However, it is quite convenient since a user may connect to his old RDP session and go on working with running programs.

In order to terminate disconnected RDP/RDS sessions automatically in a specified time period, you need to set session limits (time-outs) correctly. If you are using an RDS server, you will have to configure session time-out parameters from the RDS collection settings in the Session tab menu.

You will have to Specify the time period after which you want to disconnect the RDP session. Lastly, a disconnected session option (by default, a session period is unlimited – Never). Thus, you can set the maximum duration of an active session (Active session limit) and end an idle session (Idle session limit). These hard time-outs are applied to all sessions in the RDS collection.

You can set RDP session time-outs using user Group Policies. You can do this either in the domain GPO editor (gpmc.msc) or the Local Group Policy Editor (gpedit.msc) on a Remote desktop session or the RDS client.

RDP session timeout settings are found under following GPO sections Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits. 

Below are the Remote Desktop time-out settings which are available:

• Set the time limitation for the disconnected sessions
• Set time duration for active but idle Remote Desktop Service sessions -> the policy allows idle RDP sessions to get terminated which has no user inputs (like typing something on the keyboard or moving a mouse)
• Set time duration for active Remote Desktop Service sessions -> it is the maximum time duration of any RDP sessions, after which it gets terminated or gets disconnected after the set time limit.
• End Session when time durations are reached -> sets the time after which an RDP session will be logged off (terminated) instead of disconnecting it.
• Lastly, set a time limitation for the logoff of RemoteApp sessions.

By default, these options are not configured. For example, to automatically terminate disconnected RDP user sessions in 7 hours, You will have to enable Set time limit for the disconnected session policy and select 7 hours from the dropdown list.

At last, save all the changes and update the Group Policy settings on your RD host (gpupdate /force). Now, the new time-out settings will be applied to the latest RDP sessions. Hence, as a result, sessions will only get disconnected after the specified time which is provided by you.

Hopefully, the information above will assist you in resolving the session time-out issue.

---------------

Regards,
Austin_M

[#3]

Thanks for your response Austin.

I have no issues with configuring GPO, Our issue is GPO isn''t working properly only for Windows 2019 Servers!!
I have configured Set time duration for active but idle Remote Desktop Service sessions to 3 hours. As per GPO, technically it has to disconnect idle session after 3 hours only. But its getting disconnected after 30 minutes itself and this happens only in Windows 2019 servers.
Same GPO works fine for Windows 2016 servers.

[#4]

@kpr208  i am having same issue.

Did you get any fix

[#5]

@effjaayNo, I have applied workaround by configuring these policies in local policy on the affected servers.

[#6]

@kpr208, when applied locally does it work.

My scenario is session is not timing out and leaving the machine inactivity limit time to free the session

[#7]

Hi,

Did you manage to fix it?

[#8]

@kpr208 Same issue here. 

[#9]

@kpr208In the year 2023, this is still an issue.

[#10]

@kpr208 

We got the exact same issue, across server 2016,2019 and 2022

[#11]

Any news on this? Im having same issue here. WS 2016, 2019 and 2022.

[#12]

@kpr208 

When you say you applied locally, was that via gpedit, the Collection Configuration or the registry directly?

New 2022 RDS deploy showing same behavior.

Thank you.

[#13]

Has this been fixed yet? If so what was/is the solution?

[#14]

@learningtec1983 

No we have not resolved this.  The user sessions continue to sit in a Disconnected state without actually closing.

Sorry to have to help for you.

[#15]

Not sure why I haven't seen this comment before. So local configuration gets the sessions to Log Off from the Disconnected state after the appropriate amount of time? Did you use registry keys, the RD Config tool or just local Policy?

I did do everything through GPO

[#16]

Austin,

Thanks for that. I used Domain GPO to set the limits and they don't apply. I"ll try using the Collection configuration and see if that helps.

[#17]

@kpr208 

Same problem for me for years now. I apply local user session settings and don't use group policy but have tested group policy settings with no success.

We upgraded from 2019 from 2012 where the local user session settings worked fine. I applied the same setting in Win 2019 where they failed. 

[#18]

@tgellar 

The only way I was able to log off was with a .bat script and another .ps1 (power shell)

.bat file

@echo off
PowerShell -Command "& {Start-Process PowerShell -ArgumentList '-ExecutionPolicy Bypass -File ""C:\Users\administrator\Documents\Script\Logoff.ps1""' -Verb RunAs}"

.ps1 file

$sessions = Get-RDUserSession | ? {$_.SessionState -eq "STATE_DISCONNECTED"}
foreach($session in $sessions) {
Invoke-RDUserLogoff -HostServer $session.HostServer -UnifiedSessionID $session.UnifiedSessionId -Force
}

After that I created a shedule to call the .bat file which in turn executes the .ps1 file

Windows Server 2019

thanks