Idle time out GPO for Remote Desktop Services sessions not working in Windows 2019 servers

%3CLINGO-SUB%20id%3D%22lingo-sub-3427477%22%20slang%3D%22en-US%22%3ERe%3A%20Idle%20time%20out%20GPO%20for%20Remote%20Desktop%20Services%20sessions%20not%20working%20in%20Windows%202019%20servers%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3427477%22%20slang%3D%22en-US%22%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHello%26nbsp%3Bkpr208%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIf%20you%20face%20a%20session%20time-limit%20policy%20issue%20that%20gets%20disconnected%20after%20the%20meantime.%20You%20can%20follow%20the%20steps%20below%20in%20order%20to%20fix%20the%20issue%2C%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBy%20default%2C%20the%20user%E2%80%99s%20RDP%20session%20in%20Windows%20may%20stay%20disconnected%20until%20the%20user%20or%20administrator%20terminates%2C%20or%20the%20computer%20is%20restarted.%20However%2C%20it%20is%20quite%20convenient%20since%20a%20user%20may%20connect%20to%20his%20old%20RDP%20session%20and%20go%20on%20working%20with%20running%20programs.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EIn%20order%20to%20terminate%20disconnected%20RDP%2FRDS%20sessions%20automatically%20in%20a%20specified%20time%20period%2C%20you%20need%20to%20set%20session%20limits%20(time-outs)%26nbsp%3Bcorrectly.%20If%20you%20are%20using%20an%20RDS%20server%2C%20you%20will%20have%20to%26nbsp%3Bconfigure%26nbsp%3Bsession%20time-out%20parameters%20from%20the%26nbsp%3BRDS%20collection%20settings%26nbsp%3Bin%20the%26nbsp%3BSession%20tab%26nbsp%3Bmenu.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20will%20have%20to%20Specify%20the%20time%20period%20after%20which%20you%20want%20to%20disconnect%20the%20RDP%20session.%20Lastly%2C%20a%20disconnected%20session%20option%20(by%20default%2C%20a%20session%20period%20is%20unlimited%20%E2%80%93%20Never).%20Thus%2C%20you%20can%20set%20the%20maximum%20duration%20of%20an%20active%20session%20(Active%20session%20limit)%20and%20end%20an%20idle%20session%20(Idle%20session%20limit).%20These%20hard%20time-outs%20are%20applied%20to%20all%20sessions%20in%20the%20RDS%20collection.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EYou%20can%20set%20RDP%20session%20time-outs%20using%20user%20Group%20Policies.%20You%20can%20do%20this%20either%20in%20the%20domain%20GPO%20editor%20(gpmc.msc)%20or%20the%20Local%20Group%20Policy%20Editor%20(gpedit.msc)%20on%20a%20Remote%20desktop%20session%20or%20the%20RDS%20client.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERDP%20session%20timeout%20settings%20are%20found%20under%20following%20GPO%20sections%26nbsp%3BComputer%20Configuration%20-%26gt%3B%26nbsp%3BPolicies%26nbsp%3B-%26gt%3B%20Administrative%20Templates%20-%26gt%3B%20Windows%20Components%20-%26gt%3B%20Remote%20Desktop%20Services%20-%26gt%3B%20Remote%20Desktop%20Session%20Host%20-%26gt%3B%20Session%20Time%20Limits.%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBelow%20are%20the%20Remote%20Desktop%20time-out%20settings%20which%20are%20available%3A%3C%2FP%3ESet%20the%20time%20limitation%20for%20the%20disconnected%20sessions%20Set%20time%20duration%20for%20active%20but%20idle%20Remote%20Desktop%20Service%20sessions%26nbsp%3B-%26gt%3B%20the%20policy%20allows%20idle%20RDP%20sessions%20to%20get%20terminated%20which%20has%20no%20user%20inputs%20(like%20typing%20something%20on%20the%20keyboard%20or%20moving%20a%20mouse)%20Set%20time%20duration%20for%20active%20Remote%20Desktop%20Service%20sessions%26nbsp%3B-%26gt%3B%20it%20is%20the%20maximum%20time%20duration%20of%20any%20RDP%20sessions%2C%20after%20which%20it%20gets%20terminated%20or%20gets%20disconnected%20after%20the%20set%20time%20limit.%20End%20Session%20when%20time%20durations%20are%20reached%26nbsp%3B-%26gt%3B%20sets%20the%20time%20after%20which%20an%20RDP%20session%20will%20be%20logged%20off%20(terminated)%20instead%20of%20disconnecting%20it.%20Lastly%2C%20set%20a%20time%20limitation%20for%20the%20logoff%20of%20RemoteApp%20sessions.%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EBy%20default%2C%20these%20options%20are%20not%20configured.%20For%20example%2C%20to%20automatically%20terminate%20disconnected%20RDP%20user%20sessions%20in%207%20hours%2C%20You%20will%20have%20to%20enable%20Set%20time%20limit%20for%20the%20disconnected%20session%20policy%20and%20select%207%20hours%20from%20the%20dropdown%20list.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAt%20last%2C%20save%20all%20the%20changes%20and%20update%20the%20Group%20Policy%20settings%20on%20your%20RD%20host%20(gpupdate%20%2Fforce).%20Now%2C%20the%20new%20time-out%20settings%20will%20be%20applied%20to%20the%20latest%20RDP%20sessions.%20Hence%2C%20as%20a%20result%2C%20sessions%20will%20only%20get%20disconnected%20after%20the%20specified%20time%20which%20is%20provided%20by%20you.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EHopefully%2C%20the%20information%20above%20will%20assist%20you%20in%20resolving%20the%20session%20time-out%20issue.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E---------------%3C%2FP%3E%3CP%3ERegards%2C%3CBR%20%2F%3EAustin_M%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3413579%22%20slang%3D%22en-US%22%3EIdle%20time%20out%20GPO%20for%20Remote%20Desktop%20Services%20sessions%20not%20working%20in%20Windows%202019%20servers%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3413579%22%20slang%3D%22en-US%22%3E%3CP%3EI%20have%20configured%20GPO%20to%20Set%20time%20limit%20for%20active%20but%20idle%20Remote%20Desktop%20Services%20sessions.%20Policy%20has%20been%20set%20to%20disconnect%20sessions%20which%20are%20idle%20for%20more%20than%203%20hours.%20But%20I%20am%20getting%20warning%20after%2030%20minutes%20itself.%20This%20GPO%20has%20been%20applied%20at%20OU%20level.%20Issue%20occurs%20only%20with%20Windows%202019%20servers.%20Session%20time%20limits%20on%20Windows%202016%20servers%20which%20are%20in%20the%20same%20OU%20works%20well.%20I%20ran%20gpresult%20%2Fh%20on%20the%20affected%20servers.%20I%20could%20see%20session%20time%20limit%20policy%20is%20applied%20properly%20still%20sessions%20are%20getting%20disconnected%20after%2030%20minutes.%3C%2FP%3E%3CP%3EAnyone%20came%20across%20this%20issue%3F%20Please%20assist%20me%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-3413579%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EWindows%20Server%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-3449931%22%20slang%3D%22en-US%22%3ERe%3A%20Idle%20time%20out%20GPO%20for%20Remote%20Desktop%20Services%20sessions%20not%20working%20in%20Windows%202019%20servers%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-3449931%22%20slang%3D%22en-US%22%3EThanks%20for%20your%20response%20Austin.%3CBR%20%2F%3E%3CBR%20%2F%3EI%20have%20no%20issues%20with%20configuring%20GPO%2C%20Our%20issue%20is%20GPO%20isn''t%20working%20properly%20only%20for%20Windows%202019%20Servers!!%3CBR%20%2F%3EI%20have%20configured%20Set%20time%20duration%20for%20active%20but%20idle%20Remote%20Desktop%20Service%20sessions%20to%203%20hours.%20As%20per%20GPO%2C%20technically%20it%20has%20to%20disconnect%20idle%20session%20after%203%20hours%20only.%20But%20its%20getting%20disconnected%20after%2030%20minutes%20itself%20and%20this%20happens%20only%20in%20Windows%202019%20servers.%3CBR%20%2F%3ESame%20GPO%20works%20fine%20for%20Windows%202016%20servers.%3C%2FLINGO-BODY%3E
Occasional Contributor

I have configured GPO to Set time limit for active but idle Remote Desktop Services sessions. Policy has been set to disconnect sessions which are idle for more than 3 hours. But I am getting warning after 30 minutes itself. This GPO has been applied at OU level. Issue occurs only with Windows 2019 servers. Session time limits on Windows 2016 servers which are in the same OU works well. I ran gpresult /h on the affected servers. I could see session time limit policy is applied properly still sessions are getting disconnected after 30 minutes.

Anyone came across this issue? Please assist me

2 Replies

@kpr208 

 

Hello kpr208,

 

If you face a session time-limit policy issue that gets disconnected after the meantime. You can follow the steps below in order to fix the issue,

 

By default, the user’s RDP session in Windows may stay disconnected until the user or administrator terminates, or the computer is restarted. However, it is quite convenient since a user may connect to his old RDP session and go on working with running programs.

 

In order to terminate disconnected RDP/RDS sessions automatically in a specified time period, you need to set session limits (time-outscorrectly. If you are using an RDS server, you will have to configure session time-out parameters from the RDS collection settings in the Session tab menu.

 

You will have to Specify the time period after which you want to disconnect the RDP session. Lastly, a disconnected session option (by default, a session period is unlimited – Never). Thus, you can set the maximum duration of an active session (Active session limit) and end an idle session (Idle session limit). These hard time-outs are applied to all sessions in the RDS collection.

 

You can set RDP session time-outs using user Group Policies. You can do this either in the domain GPO editor (gpmc.msc) or the Local Group Policy Editor (gpedit.msc) on a Remote desktop session or the RDS client.

 

RDP session timeout settings are found under following GPO sections Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits

 

Below are the Remote Desktop time-out settings which are available:

  • Set the time limitation for the disconnected sessions
  • Set time duration for active but idle Remote Desktop Service sessions -> the policy allows idle RDP sessions to get terminated which has no user inputs (like typing something on the keyboard or moving a mouse)
  • Set time duration for active Remote Desktop Service sessions -> it is the maximum time duration of any RDP sessions, after which it gets terminated or gets disconnected after the set time limit.
  • End Session when time durations are reached -> sets the time after which an RDP session will be logged off (terminated) instead of disconnecting it.
  • Lastly, set a time limitation for the logoff of RemoteApp sessions.

 

By default, these options are not configured. For example, to automatically terminate disconnected RDP user sessions in 7 hours, You will have to enable Set time limit for the disconnected session policy and select 7 hours from the dropdown list.

 

At last, save all the changes and update the Group Policy settings on your RD host (gpupdate /force). Now, the new time-out settings will be applied to the latest RDP sessions. Hence, as a result, sessions will only get disconnected after the specified time which is provided by you.

 

Hopefully, the information above will assist you in resolving the session time-out issue.

 

---------------

Regards,
Austin_M

Thanks for your response Austin.

I have no issues with configuring GPO, Our issue is GPO isn''t working properly only for Windows 2019 Servers!!
I have configured Set time duration for active but idle Remote Desktop Service sessions to 3 hours. As per GPO, technically it has to disconnect idle session after 3 hours only. But its getting disconnected after 30 minutes itself and this happens only in Windows 2019 servers.
Same GPO works fine for Windows 2016 servers.