How to enforce AD Users Sessions tab settings to sign users out of their RDS sessions?

Question

How to enforce AD Users Sessions tab settings to sign users out of their RDS sessions?

Chris H 1

We have a small handful of users that don't sign out of their RDS sessions at the end of the day. Often they will remain connected for several days.

In an attempt to sign these specific users out of their RDS sessions centrally, I put the following settings in place within their Active Directory user accounts, under the Sessions tab:

End a disconnected session - 3 hours
Active session limit - Never
Idle session limit - 3 hours
When a session limit is reached, or a connection is broken - End session

However the settings don't seem to do anything - the users are still able to remain signed in all week.

Does anyone know if there is a GPO that I need to edit to enforce the settings? Or if there are some additional steps I need to take to make the settings take effect?

Thanks

3 answers

Your answer

Answer 1

Open Group Policy Management on the server in question and navigate to:

User Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits

Enable the item named: Set time limit for active but IDLE Remote desktop service sessions.

Select the desired time limit for the inactive session.

Enable the item named: End session when time limits are reached.

This setting will be responsible for the user Logoff after the inactivity period is reached.

To save it you'll need to close down the Group Policy Editor.

Afterwards, The system will give a warning message 2 minutes before disconnecting the Remote desktop session.

EDIT: I forgot to mention that you'll need to create a new GPO. Then right-click to edit it, and follow down the path I mentioned above.

If you find this answer useful, please up-vote and accept as the solution so that other Q/A users' can easily find solutions to related issues. Thanks.

Answer 2

Hi,

On your RD Connection Broker, Server Manager -- RDS -- Collections -- <yourcollectionname> -- Tasks -- Edit Properties -- Session tab, modify the timeouts to fit your needs. Please note that the changes will only take effect for new sessions that are made after you save your changes. In other words, any sessions that are currently on your server (whether Active or Disconnected) will not have the timeouts applied. You need to sign off these existing sessions and next time the users connect they will have the updated timeouts.

Thanks.

-TP

Answer 3

Chris H 1

@TP Those settings affect all users though. I'm looking to just apply it to specific users. @Jonathon Kindred 's suggestion sounds like a possibility, although I would really like to find out how to get the Active Directory user account Session tab settings to take effect. They seem to be the easiest way of applying the settings on a per-user basis.

Does anyone know how to make those settings properly take effect?

TP 124.7K Reputation points Volunteer Moderator

2022-11-30T17:36:11.733+00:00

Correct, the timeouts set on the collection affect all users since they apply to the listener. The reason the user timeouts don't work is the settings applied to the listener are set to override the user object settings. From Server 2012 onward they removed the ability in the GUI to allow individual settings to Inherit from the user object. You could still change the inherit settings if you want to, however, certain changes to the collection will cause your setting changes to be overwritten again, requiring you to make them again.

The other thing about the user object settings to be aware of is there was a change several versions back to not download (from AD) TS-related settings from the user object during logon to deal with performance issues under certain circumstances. This can be reverted via registry change, and may or may not apply to your case depending on how your environment is set up. This matters because if the user object TS settings aren't downloaded, then your user timeouts wouldn't be applied, even if the server is set to inherit the timeouts from user object.

I think the group policy method above is reasonable if you need different timeouts to apply even though I generally try to steer people away from making group policy objects with settings that conflict with the collection, as this can cause errors in certain cases when making changes to the collection. I think in this specific case it shouldn't cause an error, but you should test yourself to be more certain.

-TP

Share via

How to enforce AD Users Sessions tab settings to sign users out of their RDS sessions?

3 answers

Your answer