Most admins set one timeout and still find ghost sessions on Monday morning. The reason is simple: idle and disconnected are two different states, they hold different things on your server, and each has its own policy. This page separates them cleanly.
Ask a room of server admins what happens when an RDP user clicks the X on their Remote Desktop window and half will say the user logged off. They did not. They disconnected. Meanwhile the user who is still connected but went for a long lunch is in a third state - idle. Windows treats these as different situations, holds different resources for each, and gives you a different policy for each one.
Confusing the two is the single most common reason auto logoff projects fail. The idle limit gets set, everyone celebrates, and the server still fills up every weekend with disconnected sessions that the idle policy never touches. Read the states below once and you will never make that mistake.
An idle session means the RDP connection is alive and the user is signed in, but there has been no keyboard or mouse input for a while. The desktop is right there on their screen (or behind a locked screen), applications are open, and the moment they wiggle the mouse they are back to work instantly.
What it holds on your server: full session memory, open application state, and - because the user is still signed in - an active login that counts toward your server's session load and, on a licensed RDS deployment, your session capacity. Idle is not harmless; it is a parked car with the engine running.
A disconnected session happens when the RDP window closes without a logoff - the user clicked X, their laptop slept, their network dropped, or they simply shut their PC. From the server's side nothing ended: the session, its applications, its unsaved documents and its login all keep running, waiting in case the user reconnects and wants everything exactly where they left it.
That convenience is genuinely useful for a dropped connection - and genuinely expensive as a habit. A disconnected Tally session still holds the company file open. A disconnected session from a shared counter PC is still a signed-in account anyone who reconnects can land in, which is also a security point, not just a performance one.
Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time LimitsA sensible office pattern: idle limit of 1 to 2 hours, disconnected limit of 30 minutes to a few hours, end session enabled. Shared or counter machines get shorter numbers on both.
Do not guess - look. On the server, Task Manager's Users tab shows each session's status and idle time in plain columns. From the command line, query session lists every session with its state, and query user adds sign-in and idle times.
Run one of these on a Monday morning before you change anything. The list of disconnected sessions with idle times measured in days is the most convincing argument you will ever show a manager for why this project matters.
When a user reconnects after a plain disconnect, they return to the same session with everything open - that is the good behaviour everyone likes. When a session has been logged off by a time limit, reconnecting starts a fresh desktop: applications closed, unsaved work gone.
Neither behaviour is a bug. The art is choosing limits long enough that a genuine coffee break survives as a disconnect, and short enough that an abandoned Friday session does not live until the next Friday.
The video shows the complete auto logoff setup for idle RDP users, click by click. Watch it end to end before you change a production server.
▶️ Watch Full VideoYes. Closing the window disconnects the session but leaves it running on the server with its applications open and memory allocated. It stays that way until the user reconnects, an administrator ends it, or a disconnected-session time limit ends it. This is why disconnected limits matter as much as idle limits.
No. Windows provides separate policies because the states are different: Set time limit for active but idle Remote Desktop Services sessions for connected-but-unused sessions, and Set time limit for disconnected sessions for closed-window sessions. Enable both, plus End session when time limits are reached if you want logoff rather than disconnect.
Open Task Manager on the server and look at the Users tab - it shows each session, its status and its idle time. From a command prompt, query session lists sessions with their states, and query user shows sign-in and idle times. Both views show the truth in seconds.