Windows OS Hub
  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux
  • Home
  • About

Windows OS Hub

  • Windows
    • Windows 11
    • Windows Server 2022
    • Windows 10
    • Windows Server 2019
    • Windows Server 2016
  • Microsoft
    • Active Directory (AD DS)
    • Group Policies (GPOs)
    • Exchange Server
    • Azure and Microsoft 365
    • Microsoft Office
  • Virtualization
    • VMware
    • Hyper-V
  • PowerShell
  • Linux

 Windows OS Hub / Windows 10 / Configuring RDP/RDS Sessions Limits (Timeouts) on Windows

February 27, 2023

Configuring RDP/RDS Sessions Limits (Timeouts) on Windows

When a user closes the RDP/RDS session window in a terminal client (mstsc.exe, RDCMan or Remote Desktop HTML5 web client) by simply clicking the cross in the top right corner without logging off, his session goes from active to a disconnected mode. In this mode, all apps, open documents, and windows are still running on a Remote Desktop computer and consuming system resources.

Contents:
  • Automatically Log off Disconnected and Idle Remote Desktop User Sessions
  • Remote Desktop Session Has Been Idle Over Its Time Limit

By default, a user’s RDP session in Windows may stay in the disconnected state until terminated by the user or administrator, or until the computer is restarted. It is quite convenient, since a user may any time connect to his previous remote desktop session and continue working with running apps and open files.

The following screenshot shows that disconnected user sessions on an RDS server running Windows Server 2019 consume about 40% of the server RAM.

disconnected user session on rds host

Also, these sessions can block open files on your file servers, cause problems with incorrect saving of data in the apps, roaming profile folders, or on User Profile Disks. Disconnected RDP sessions often cause a domain user account lockout issue after a password change (when the RDS session continues to run under the user’s old password).

Using the qusercommand, you can view when a user RDP session was started, how long it was idle, and the current session state.

quser command - list all rds session with logon time, idle and state

You can also display information about the duration of user sessions in the RDS farm using a PowerShell script (specify the FQDN of your RDS Connection Broker server):

$connectionBrocker = “mun-rdscb.woshub.com"
Get-RDUserSession -ConnectionBroker $connectionBrocker |select-object -Property CollectionName, HostServer, DomainName, UserName, ServerIPAddress, CreateTime, DisconnectTime,  SessionState, IdleTime , SessionID , `
@{Name='SessionAge ([days.]hours:minutes)';Expression={ ((get-date ) - $_.CreateTime) } }

You can configure the maximum duration of active, disconnected, and idle (no user activity) sessions for Remote Desktop Services.

Automatically Log off Disconnected and Idle Remote Desktop User Sessions

To automatically end disconnected RDP/RDS sessions in a specified period of time, you need to set session limits (timeouts) correctly.

If you have a Remote Desktop Services farm deployed on Windows Server, you can configure user session timeout settings in the RDS collection settings on the Session tab.

Specify the time period, after which you want to kill a disconnected remote desktop session, at the End a disconnected session option (by default, an RDP session duration is unlimited – Never). You can also set the maximum time of an active user session (Active session limit) and end an idle session (Idle session limit). These hard timeouts are applied to all user sessions in the RDS collection.

RDS server timeouts in session collection properties on RD session host

In Windows Server 2022/2019/2016/2012R2, you can set RDP session timeouts using Group Policies. You can do it either in the domain GPO editor (gpmc.msc) or in the Local Group Policy Editor (gpedit.msc) on a specific RDS host (or on a desktop version of Windows if you have allowed multiple RDP connections to it).

The settings of RDP session timeouts are located in the following GPO section Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits. The following Remote Desktop timeout settings are available:

  • Set time limit for disconnected session;
  • Set time limit for active but idle Remote Desktop Services sessions — the policy allows to end idle RDP sessions that have no user input (like moving a mouse or typing something on a keyboard);
  • Set time limit for active Remote Desktop Services sessions — it is the maximum time of any RDP session (even an active one), after which it switches to the disconnected state;
  • End Session when time limits are reached — sets the time, after which an RDP session will be terminated (logoff) instead of disconnecting it;
  • Set time limit for logoff of RemoteApp sessions.

configure RDP/RDS session time limits via GPO

By default, these options are not configured. To automatically end all disconnected RDP user sessions in 8 hours, enable the “Set time limit for disconnected sessions” policy and select 8 hours in the dropdown list.

"Set time limit for disconnected session" - group policy parameter to restrict rdp session time

Save the changes and update the Group Policy settings on your RD host (gpupdate /force). New timeout settings will only be applied to new RDP sessions (you will have to end the current user sessions on RDSH manually ).

GPO settings take precedence over timeout settings in the RDS collection.

You can find the same RDP timeout settings in the user GPO section: User Configuration -> Administrative Templates -> Windows Components. Using the policy from the user section, you can more flexibly configure user groups with different limits on the duration of RDP sessions.

You can also set RDP session time limits through the registry. The following DWORD parameters from HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services registry key corresponding to the Group Policy options described above:

  • MaxDisconnectionTime
  • MaxIdleTime
  • MaxConnectionTime
  • MaxDisconnectionTime
  • RemoteAppLogoffTimeLimit

For example, to set the maximum duration for a disconnected RDP session to 15 minutes (90000 ms), you can change a registry parameter using the following PowerShell command:

Set-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" -Name MaxDisconnectionTime -Type 'DWord' -Value 900000

You can also set the limits of an RDP session on the Settings tab in the properties of a local (lusrmgr.msc) or domain user (dsa.msc — Active Directory Users and Computers console). The following options are available here:

  • End a disconnected session;
  • Active session limit;
  • Idle session limit;
  • When a session limit is reached or connection is broken: “Disconnect from session” or “End session”;
  • Allow reconnection: “From any Client” or “From originating client only”.

rds session timeouts in user properties in active directory

You shouldn’t make RDP session timeouts too short, otherwise, user sessions will end almost immediately after they become inactive.

If you have an RD Gateway Server deployed for remote access to RDS hosts, you can configure separate timeouts for users connected via RDGW (open the connection authorization policy and go to the Timeouts tab).

remote desktop gateway: session timeout settings

In Windows Server 2008 R2, you could also set RDP session timeouts using a special tsconfig.msc (RD Session Host Configuration) console. It was enough to open the console and right-click RDP-Tcp -> Properties. The session timeout limits are located on the Sessions tab. However, there is no such console in newer Windows Server versions (although you can manually copy tsadmin.msc and tsconfig.msc files and use these consoles on newer Windows Server versions as well).

tsconfig.msc session limits on windows server 2008 r2

Remote Desktop Session Has Been Idle Over Its Time Limit

After configuring RDS timeouts users will see the following warning before disconnecting an idle session:

Idle timer expired
Session has been idle over its time limit.
It will be disconnected in 2 minutes.
Press any key to continue the session.

idle timer expired rdp session message

And before the user disconnect, the Event ID 26 is logged in the System Event Viewer.

Learn more about RDP connection logs.

event id 26: session time limit reached

You can disable this warning by setting the EnableTimeoutWarning = 0 in the WMI class Win32_TSSessionSettings.

Set-WmiInstance -Path "\\localhost\root\CIMV2\TerminalServices:Win32_TSSessionSetting.TerminalName='RDP-Tcp'" -Argument @{EnableTimeoutWarning=0}

Now, when Windows automatically ends idle RDP sessions, the user will receive the following message from the RDP client:

Your Remote Desktop Services session ended because the remote computer didn’t receive any input from you.

 Remote Desktop Services session ended - remote computer didn’t receive any input from you

In some cases, you may encounter this error in the RDP client:

Your Remote Desktop Services session has ended. Another user connected to the remote computer, so your connection was lost. Try connecting again, or contact your network administrator.

RDP session ended - another user connected to the remote computer

This means that someone else signed into the computer via RDP when the number of simultaneous RDP sessions on the computer is restricted by the Limit number of connections parameter (for example, only one remote session is available on desktop Windows versions). Or you have logged in to the RDP host from a new computer.

You can allow multiple connections under the same user account to the RDP host using the GPO option Restrict Remote Desktop Services users to a single Remote Desktop Services session = Disabled (under Computer Configuration -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Connections).

gpo: restrict RDS user to single session

6 comments
11
Facebook Twitter Google + Pinterest
Windows 10Windows 11Windows Server 2019
previous post
How to Check Who Restarted (Shutdown) Windows Server
next post
How to Add/Remove Drivers to a Windows WIM/ISO Install Image

Related Reading

How to Repair EFI/GPT Bootloader on Windows 10...

March 16, 2024

How to Restore Deleted EFI System Partition in...

March 11, 2024

How to Allow Multiple RDP Sessions on Windows...

March 15, 2024

How to Run Program without Admin Privileges and...

June 8, 2023

Wi-Fi (Internet) Disconnects After Sleep or Hibernation on...

March 15, 2024

How to Install Remote Server Administration Tools (RSAT)...

March 17, 2024

How to Repair Windows Boot Manager, BCD and...

March 11, 2024

Refresh AD Groups Membership without Reboot/Logoff

March 15, 2024

6 comments

AZ-140 Exam Study Guide (Configure Microsoft Azure Virtual Desktop) August 6, 2021 - 4:40 am

[…] Configuring RDP/RDS session timeout on Windows […]

Reply
Pajeu August 17, 2021 - 7:52 pm

Dzięki Adam!

Reply
Huleos March 20, 2022 - 4:42 pm

According to this scheme, it will terminate all RDP sessions, including the administrator, if he connects remotely. Цhich is not acceptable, since the administrator has ran the necessary programs such as a hardware server, task server, video recording, and much more.

Reply
serg October 18, 2022 - 1:03 pm

How to log off all disconnected user RDP sessions via PowerShelll?

Reply
Janek October 18, 2022 - 8:21 pm

adam? czy to polski blog?

Reply
Freedom January 26, 2024 - 12:13 pm

@SERG

You can log off all disconnected user RDP sessions via PowerShell by using the `Invoke-RDUserLogoff` cmdlet. Here is a sample script:

$sessions = Get-RDUserSession | ? {$_.SessionState -eq “STATE_DISCONNECTED”}
foreach($session in $sessions) {
Invoke-RDUserLogoff -HostServer $session.HostServer -UnifiedSessionID $session.UnifiedSessionId -Force
}

In this script:
– `Get-RDUserSession` retrieves all user sessions.
– The `? {$_.SessionState -eq “STATE_DISCONNECTED”}` part filters for sessions that are disconnected.
– `Invoke-RDUserLogoff -HostServer $session.HostServer -UnifiedSessionID $session.UnifiedSessionId -Force` logs off each disconnected session.

Please note that this script should be run on the Connection Broker. Be careful when running this script as it will forcefully log off all disconnected sessions, which may result in a loss of unsaved data.

Quelle:
(1) Log off all Remote Desktop Session Users – Windows Server. https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/log-off-terminal-server-session-users-command-prompt.
(2) Invoke-RDUserLogoff (RemoteDesktop) | Microsoft Learn. https://learn.microsoft.com/en-us/powershell/module/remotedesktop/invoke-rduserlogoff?view=windowsserver2016-ps.
(3) logout – Powershell to find out disconnected RDP session and log off at …. https://stackoverflow.com/questions/43352905/powershell-to-find-out-disconnected-rdp-session-and-log-off-at-the-same-time.

Reply

Leave a Comment Cancel Reply

join us telegram channel https://t.me/woshub
Join WindowsHub Telegram channel to get the latest updates!

Recent Posts

  • Map a Network Drive over SSH (SSHFS) in Windows

    May 13, 2025
  • Configure NTP Time Source for Active Directory Domain

    May 6, 2025
  • Cannot Install Network Adapter Drivers on Windows Server

    April 29, 2025
  • Change BIOS from Legacy to UEFI without Reinstalling Windows

    April 21, 2025
  • How to Prefer IPv4 over IPv6 in Windows Networks

    April 9, 2025
  • Load Drivers from WinPE or Recovery CMD

    March 26, 2025
  • How to Block Common (Weak) Passwords in Active Directory

    March 25, 2025
  • Fix: The referenced assembly could not be found error (0x80073701) on Windows

    March 17, 2025
  • Exclude a Specific User or Computer from Group Policy

    March 12, 2025
  • AD Domain Join: Computer Account Re-use Blocked

    March 11, 2025

Follow us

  • Facebook
  • Twitter
  • Telegram
Popular Posts
  • How to Allow Multiple RDP Sessions on Windows 10 and 11
  • How to Repair EFI/GPT Bootloader on Windows 10 or 11
  • How to Restore Deleted EFI System Partition in Windows
  • Network Computers are not Showing Up in Windows 10/11
  • How to Run Program without Admin Privileges and Bypass UAC Prompt
  • Fix: BSOD Error 0x0000007B (INACCESSABLE_BOOT_DEVICE) on Windows
  • Install and Manage Windows Updates with PowerShell (PSWindowsUpdate)
Footer Logo

@2014 - 2024 - Windows OS Hub. All about operating systems for sysadmins


Back To Top