3

We have a single RDS (W2K16) which hosts all roles (Broker, Gateway, Session host). On the collection settings, we specified all session limits as "never". Still all users are logged off 6 hours after their session got disconnected (found this in the eventlog). I've created a GPO which also sets the session limits to never (computer configuration), but this also didn't help. Sessions are still logged of 6 hours after disconnection I checked the registry, and the keys are correct:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services]
"MaxDisconnectionTime"=dword:00000000
"MaxIdleTime"=dword:00000000
"MaxConnectionTime"=dword:00000000
"fResetBroken"=dword:00000000

I also checked the user objects in AD, and on the users the "session" tab also states "never" on all settings.

Next I checked the RD Gateway policies, but also there, no limits specified...

This happens on all users logging in to the RDS.

Is there any other place where session limits can be set?

EDIT: screenshots of settings:

Collection: Collection User:

User

GPO: GPO Settings

Gateway policies: enter image description here

Mickeybyte
  • 81
  • 2
  • 2
  • 9
  • You sure the GPOs get applied correctly? Does some local security policy override your settings maybe? Please specify what you mean by "all settings", maybe you _did_ forget to set some. – Lenniey Sep 13 '17 at 07:31
  • I've added screenshots of the settings – Mickeybyte Sep 13 '17 at 12:58
  • There should be at least two computer configuration policies, try to set them, too – Lenniey Sep 14 '17 at 07:55
  • Sorry for the late reply. What do you mean by 2 computer policies? I know only of one, the one which is shown in the screenshot above. – Mickeybyte Oct 09 '17 at 06:55
  • Just got informed by our customer that the issue has been solved. I have no idea what happened, but it seems the above settings took some "days" before getting applied (although server was rebooted and GPO's where manually applied). – Mickeybyte Oct 09 '17 at 08:06

1 Answers1

0

Issuing gpupdate /force will make sure the GPO policies are applied to every system affected.

The 'delay' you mention seems an indication this was not used.

Joffrey
  • 2,011
  • 1
  • 11
  • 14
ShotgunPR
  • 1
  • 1