13.07.2020
During the remote work of users, it is important to configure so that the programs, as well as scripts and macros launched by the client, continue their work, and do not close immediately when the session is broken. The basis for solving the problem is just setting timeouts for RDP sessions. Let's consider how to do it.
Install Remote Desktop Service. To do this, open the “Server Control Panel”. In the window that opens, select the second item - “Add roles and components”. The role setup wizard window provides a General introduction. This text will appear every time you try to add roles or a server component. To prevent this information from appearing again, we recommend checking the box “Skip this page by default”. Press the button “ Next ”. The next step is to select the type of installation - “Installing Remote Desktop Services”. Click “ Next ”. In the next step, select the type of deployment - “Multipoint Services”. Usually, this option is set by default. Click on the button “Next”. The next step is choosing the server for which the installation is performed. In our case, the server has already been added, since we are considering installing on a single server not added to the domain. Click “ Next ”. The next step confirms the choice. Install a daw, which will allow the system to restart the server automatically if necessary. Click the button “Expand”. Important! During the installation, all RDP connections may be closed, and the server may also be restarted several times without additional notification. Waiting for the installation process to finish. The window says “Successfully” three times. Close the installation window. We begin to configure group policies. To configure group policies, run the appropriate console. In the program run (Windows + R), enter “gpedit.msc”. Press the button “OK” or enter. In the window that opens, follow the path Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Remote Desktop Session Host → Session Time Limit. The following parameters must be set to “Enabled”:
To change the values, right-click on each of the items. In the context menu, select “Edit”. A similar window will open by double-clicking. In the window that opens, set the state as “Enabled”. Then set the time frames. In the end, press the button "OK”. The choice of time ranges is up to the system administrator. The parameter “End session when the time limit is reached” has no time ranges. This parameter you just need to enable. After enabling all the options, the window will look as follows. This completes the setup.
By default, when a user closes the RDP/RDS session window in a terminal client (mstsc.exe, RDCMan or Remote Desktop HTML5 web client) by simply clicking the cross in the top right corner without logging off, his session goes into disconnected mode. In this mode, all apps, open files and windows are still running on a remote desktop server and consuming resources. By default, a user’s RDP session in Windows may stay in the disconnected state until terminated by the user or administrator, or until the computer is restarted. It is quite convenient, since a user may any time connect to his old remote desktop session and go on working with running programs or open files. In the following screenshot you can see that the disconnected user sessions on the RDS server running Windows Server 2016 are using about 40% of the server RAM. Also, these sessions may block open files on your file servers, cause problems of incorrect saving of data in the apps, roaming profile folders or on User Profile Disks.  Using the quser command, you can view when a user RDP session was started, how long it was idle and the current session state. To automatically terminate disconnected RDP/RDS sessions in a specified period of time, you need to set session limits (timeouts) correctly. If you use an RDS server, you can configure session timeout parameters in the RDS collection settings on the Session tab. Specify the time period, after which you want to kill a disconnected remote desktop session, in the End a disconnected session option (by default, a session period is unlimited – Never). You can also set the maximum time of an active session (Active session limit) and end an idle session (Idle session limit). These hard timeouts are applied to all sessions in the RDS collection. You can also set the limits of an RDP session in the properties of a local (lusrmgr.msc) or domain user (dsa.msc — Active Directory Users and Computers). In Windows Server 2012 R2/2016/2019, you can set RDP session timeouts using Group Policies. You can do it either in the domain GPO editor (gpmc.msc) or in the Local Group Policy Editor (gpedit.msc) on an RDS server or client (if you are using a desktop Windows edition as a terminal server). The settings of RDP session timeouts are located in the following GPO section Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Remote Desktop Services -> Remote Desktop Session Host -> Session Time Limits. The following Remote Desktop timeout settings are available:
By default, these options are not configured. To automatically terminate disconnected RDP user sessions in 8 hours, enable the Set time limit for disconnected session policy and select 8 hours in the dropdown list. Save the changes and update the Group Policy settings on your RD host (gpupdate /force). New timeout settings will be applied to new RDP sessions only (you will have to end the current RDS sessions manually). In Windows Server 2008 R2, you could also set RDP session timeouts using a special console: tsconfig.msc (RD Session Host Configuration). It was enough to open the console and right-click RDP-Tcp -> Properties. The settings of session limits are located on the Sessions tab. However, there is no such console in newer Windows Server versions (although you can manually copy tsadmin.msc and tsconfig.msc files and use these consoles on newer Windows Server versions as well). |
