Detections
Analytics
18.9.58.3.10.2 Ensure 'Set time limit for disconnected sessions' is set to 'Enabled: 1 minute'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This policy setting allows you to configure a time limit for disconnected Remote Desktop Services sessions.The recommended state for this setting is: 'Enabled: 1 minute'.
Rationale:
This setting helps to prevent active Remote Desktop sessions from tying up the computer for long periods of time while not in use, preventing computing resources from being consumed by large numbers of disconnected but still active sessions.
In addition, old, forgotten Remote Desktop sessions that are still active can cause password lockouts if the user's password has changed but the old session is still running.
For systems that limit the number of connected users (e.g.
servers in the default Administrative mode - 2 sessions only), other users' old but still active sessions can prevent another user from connecting, resulting in an effective denial of service.
This setting is important to ensure a disconnected session is properly terminated.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Enabled: 1 minute':Computer Configuration\Policies\Administrative Templates\Windows Components\Remote Desktop Services\Remote Desktop Session Host\Session Time Limits\Set time limit for disconnected sessions
Note: This Group Policy path is provided by the Group Policy template 'TerminalServer.admx/adml' that is included with all versions of the Microsoft Windows Administrative Templates.
Impact:
Disconnected Remote Desktop sessions are deleted from the server after 1 minute.
Note that disconnected session time limits do not apply to console sessions.
See Also
Item Details
Category: ACCESS CONTROL
References: 800-53|AC-12, CSCv6|16.4, CSCv6|16.5
Plugin: Windows
Control ID: dd7104ecbc5a6339741e76f767e436bd7bdf90ad7975c415e1bb6adbba7a58cd