Auto Logoff Idle RDP Users in 5 Mins

Know the Three Session States First

Every Remote Desktop session on the server is in one of three states. Active means the user is connected and working. Idle means connected, but not touching the keyboard or mouse. Disconnected means the user closed the RDP window — but the session, and every application inside it, is still running on the server.

This distinction matters because Windows has a separate policy for each state. Setting only an idle limit is why disconnected sessions from Friday are still alive on Monday. See the current state of your server yourself — open Command Prompt on the session host and run:

query session

The same picture is visible in Task Manager on the Users tab.

Open the Group Policy Editor

For one server, open the local Group Policy editor from the Run dialog:

gpedit.msc

If you manage many servers through a domain, use the Group Policy Management Console instead and edit a GPO linked to the OU that holds your session host servers:

gpmc.msc

Then navigate to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits. Prefer the Computer side for a server-wide rule, so the limit follows the server no matter which user signs in. The same limits can also be set per RDS collection under Server Manager > Remote Desktop Services > Collections > Properties > Session — but manage them in one place only, because Group Policy wins when the two conflict.

Set the Idle Session Time Limit

Open Set time limit for active but idle Remote Desktop Services sessions, set it to Enabled and choose the idle limit — 5 minutes in the video.

When a connected session sits unused for that long, Windows first shows the user an on-screen warning that they are about to be signed out, and then the limit is reached. What happens at that point — disconnect or full logoff — is decided by the next step.

Set the Disconnected Limit and the Logoff Switch

Still inside the Session Time Limits folder, set the other two policies:

Set time limit for disconnected sessions — enable it and choose how long a disconnected session may live before it is ended. 30 minutes to 1 day are common choices. This is the policy that cleans up the sessions users abandoned by closing the RDP window.

End session when time limits are reached — enable it. This single setting is what turns a timeout into a logoff instead of only a disconnect. Without it, an idle user is merely disconnected and the session keeps running — the exact problem you started with.

Keep the Admin Account Out of the Rule

The video's setup deliberately leaves the administrator out — an admin session that is mid-task on the server must not be signed out from under the person running the server. The clean way to do this is targeting, not a second conflicting policy:

Put the regular RDP users in their own OU or security group and apply the session-limit GPO to them; keep admin accounts outside that scope (with security filtering on the GPO if needed). On an RDS deployment, the same result comes from giving those users their own collection with its own session settings.

The same route covers genuine exceptions — the month-end report or overnight export account whose keyboard is idle while the machine is busy working. Give such an account its own group with longer, or no, idle limits, and write the exception down with a reason and an owner. An exception that is not written down is not an exception — it is a rumour.

Apply the Policy, Warn Users and Test

Apply the policy on the server right away instead of waiting for the next automatic refresh:

gpupdate /force

Then test before trusting it: sign in with one test account over RDP, leave the session untouched past the idle limit, and watch the warning appear and the logoff happen. Run query session again and confirm the session is fully gone, not just disconnected. Also test the disconnected path — connect, close the RDP window, and check the session ends after the disconnected limit. Only then roll the same settings out to everyone.