Remote Desktop session timeouts decide how long a user's session can stay active, sit idle, or remain disconnected before Windows acts on it. Get them wrong and you either leave abandoned sessions consuming memory and licenses, or you cut off users mid-task. On Windows Server 2025 you configure these limits in three ways: Group Policy (local gpedit.msc or domain gpmc.msc), the registry, or — for an RDS deployment — the collection properties and the Set-RDSessionCollectionConfiguration PowerShell cmdlet.
A separate but related setting is the keep-alive connection interval. Timeouts limit sessions on purpose; keep-alive does the opposite, sending periodic checks so a session that is genuinely in use isn't mistaken for a dead connection and dropped by network equipment. This guide walks through both, shows the exact policy names and registry values, and explains how the settings interact so you can apply them safely.
Before you start
What you will learn
- How to set idle, active, and disconnected RDP session time limits on Windows Server 2025, control whether a session is disconnected or ended at the limit, and enable a keep-alive interval so sessions survive brief network drops.
- Session limits reclaim resources and reduce the security exposure of forgotten, still-logged-in sessions, while keep-alive stops legitimate work from being killed by idle-connection drops on firewalls and load balancers.
Requirements
- You need local administrator rights on the target Windows Server 2025 host (or domain Group Policy rights when applying centrally), plus the ability to reach the Group Policy editor, Registry Editor, or the RD Connection Broker for a deployment.
- A standalone Windows Server 2025 host with RDP enabled, or an RDS deployment with at least one session collection and an RD Connection Broker.
- Local Administrator on the RD Session Host / target server
- Group Policy editing rights (domain) if configuring via a GPO linked to an OU
Good to know
- About 15 minutes for a single server; longer if you are testing Group Policy propagation across an RDS deployment.
- Paths and registry values verified against Microsoft Learn documentation that applies to supported Windows Server versions, including Windows Server 2025.
Quick answer
On Windows Server 2025, configure RDP session timeouts under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits. Set the idle, active, and disconnected limits, then use "End session when time limits are reached" to control disconnect vs. log off. Enable keep-alive under the Connections node. In an RDS deployment, set the same limits per collection with Set-RDSessionCollectionConfiguration.
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time LimitsSet-RDSessionCollectionConfiguration -CollectionName "<Collection>" -IdleSessionLimitMin 15 -DisconnectedSessionLimitMin 60 -BrokenConnectionAction LogOffStep-by-step tutorial
7 stepsChoose your configuration method
Decide whether to configure a standalone host (Group Policy or registry) or a full RDS deployment (collection properties or PowerShell), because the setting that wins depends on it.
Identify what you are managing:
- Standalone server / RDP for remote administration — configure with Group Policy (
gpedit.msclocally orgpmc.mscfor a domain GPO) or directly in the registry. - Remote Desktop Services deployment (RD Connection Broker + session collections) — set the defaults in the collection properties or with the
Set-RDSessionCollectionConfigurationPowerShell cmdlet.
Remember the precedence order: Group Policy settings take precedence over the deployment/collection defaults, and Computer Configuration policies take precedence over User Configuration policies. If you mix methods, the strictest applicable policy usually wins, so pick one primary method per environment.
For a single server used only for remote administration, local Group Policy (gpedit.msc) is the quickest path and is used for the rest of this guide.
Open the Session Time Limits Group Policy node
Reach the policies that control idle, active, and disconnected RDP sessions.
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time LimitsPress Win + R, type gpedit.msc, and press Enter (use gpmc.msc and edit a linked GPO to apply at the domain level). Then browse to:
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits
You should see the session limit policies, including *Set time limit for active but idle Remote Desktop Services sessions*, *Set time limit for active Remote Desktop Services sessions*, *Set time limit for disconnected sessions*, and *End session when time limits are reached*.
gpedit.mscThe User Configuration branch has a similar node, but Computer Configuration is recommended because it applies to every user of the host and takes precedence over User Configuration.
Set the idle, active, and disconnected session limits
Define how long a session can be idle or active, and how long a disconnected session is kept before it ends.
Session Time Limits > (each policy) > Enabled > choose durationConfigure each policy by double-clicking it, selecting Enabled, and choosing a duration from the dropdown:
- Set time limit for active but idle Remote Desktop Services sessions — ends or disconnects a session after it has been idle for the chosen time (registry value
MaxIdleTime). - Set time limit for active Remote Desktop Services sessions — limits total connected time regardless of activity (
MaxConnectionTime). - Set time limit for disconnected sessions — how long a disconnected session is retained before it is ended (
MaxDisconnectionTime).
Click Apply and OK on each. A common baseline is a 15–30 minute idle limit and a 1–2 hour disconnected limit; keep the active limit at *Never* unless you have a policy reason to cap total session time.
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'MaxIdleTime' -Value 900000 -PropertyType DWord -ForceIf you set the values directly in the registry instead of Group Policy, they live at HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services as REG_DWORD values in milliseconds — for example MaxIdleTime = 900000 is 15 minutes and MaxDisconnectionTime = 3600000 is 1 hour.
Choose whether to disconnect or end sessions at the limit
Control what happens when a limit is reached: by default the session is disconnected; enable this policy to log it off completely.
Session Time Limits > End session when time limits are reached > EnabledDouble-click End session when time limits are reached, set it to Enabled, then Apply and OK.
- Not configured / Disabled — a session that hits its idle or active limit is disconnected (it keeps running in the background and can be resumed).
- Enabled — the session is logged off (ended), freeing all its resources.
Enable this when you want idle or over-limit sessions fully closed rather than lingering as disconnected sessions. The matching registry value is fResetBroken (1 = end the session).
New-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services' -Name 'fResetBroken' -Value 1 -PropertyType DWord -ForceThis setting only affects sessions that hit the active or idle limits. Disconnected sessions are governed separately by *Set time limit for disconnected sessions* (MaxDisconnectionTime).
Configure the keep-alive connection interval
Keep in-use sessions from being dropped by idle-connection timeouts on firewalls, VPNs, or load balancers.
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections > Configure keep-alive connection intervalIn the same Group Policy tree, browse to:
Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections
Double-click Configure keep-alive connection interval, set it to Enabled, and enter a Keep-Alive interval in minutes (valid range 1 to 999999). A value of 1 makes the server check session state every minute, which keeps the TCP connection looking active and prevents idle-connection drops. Click Apply and OK.
When set via Group Policy, this writes KeepAliveEnable (and the interval) to SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services.
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server]
"KeepAliveEnable"=dword:00000001
"KeepAliveInterval"=dword:00000001The .reg example shows the direct registry method from Microsoft KB2507353, which uses HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server with KeepAliveInterval (in minutes) and KeepAliveEnable. Prefer Group Policy where possible so the setting is documented and reversible. See the critical warning about restarting the Remote Desktop Services service while keep-alive is enabled.
Set limits per collection in an RDS deployment (optional)
Apply the same idle, active, and disconnected limits as deployment defaults for a session collection.
Server Manager > Remote Desktop Services > Collections > (collection) > Tasks > Edit Properties > SessionFor a Remote Desktop Services deployment, set the defaults on the collection, which then apply to every RD Session Host in it.
GUI: Open Server Manager > Remote Desktop Services > Collections, select your collection, choose Tasks > Edit Properties, and open the Session tab to set the idle, active, and disconnected limits and the end-session behavior.
PowerShell: run the cmdlet below on the RD Connection Broker, adjusting the minute values and the broken-connection action (Disconnect or LogOff).
Set-RDSessionCollectionConfiguration -CollectionName "<Collection>" -IdleSessionLimitMin 15 -ActiveSessionLimitMin 0 -DisconnectedSessionLimitMin 60 -BrokenConnectionAction LogOff -AutomaticReconnectionEnabled $trueThese collection defaults are applied to HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp on the session hosts. If a Group Policy session-limit setting is also present, the Group Policy value takes precedence over the collection default.
Apply the settings and verify
Force the policy to refresh and confirm the limits are active.
Refresh Group Policy and confirm the values:
- Open an elevated Command Prompt or PowerShell and run
gpupdate /force. - Have affected users reconnect or log off and back on — new session limits only take effect on the next connection.
- Confirm the applied registry values under
HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services, or rungpresult /h C:\gpreport.htmland review the RDS session-limit policies.
gpupdate /forceTo watch a real timeout, connect a test account, leave it idle past the idle limit, and confirm you receive the message "Your Remote Desktop Services session ended because the remote computer didn't receive any input from you."
How to Confirm Your RDP Session Limits Are Applied
After gpupdate /force and a reconnect, verify the configuration in two places. First, check the policy registry key HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services — the values you set (MaxIdleTime, MaxConnectionTime, MaxDisconnectionTime, fResetBroken, and keep-alive values) should be present as REG_DWORD entries in milliseconds (keep-alive interval is in minutes). Second, test the behavior: leave a test session idle past the idle limit and confirm it disconnects or logs off with the expected message. For an RDS deployment, run Get-RDSessionCollectionConfiguration -CollectionName "<Collection>" on the RD Connection Broker and confirm the minute values match what you set.
- The configured session-limit registry values are present, idle/active sessions end at their limits, disconnected sessions are cleared at their limit, and in-use sessions stay connected because of the keep-alive interval.
- If limits don't apply, a higher-precedence Group Policy or a conflicting collection default is overriding them, the value was written in the wrong unit (seconds vs. milliseconds), or the user simply hasn't reconnected since the change.
- 15-minute idle limit expressed in milliseconds in the registry.
- Disconnected sessions are ended after 1 hour.
- Sessions reaching a limit are logged off (ended) rather than left disconnected.
- Server checks session state every 1 minute to keep active connections alive.
Troubleshooting
Session limits are not applying on some session hosts
Cause: A Group Policy scope or precedence problem: the GPO isn't linked to the OU containing the hosts, or a higher-precedence policy overrides it. Group Policy also takes precedence over collection defaults.
Confirm the GPO is linked and enforced on the correct OU, run gpupdate /force on the host, and use gpresult /h C:\gpreport.html to see which policy won. Reconcile Computer vs. User Configuration — Computer Configuration wins.
Sessions are only disconnected, never logged off
Cause: "End session when time limits are reached" is not enabled, so sessions that hit the idle or active limit are disconnected and keep running instead of being ended.
Enable End session when time limits are reached (registry fResetBroken = 1). Note this affects only the active and idle limits; disconnected sessions are cleared by the separate *Set time limit for disconnected sessions* policy.
The server won't accept RDP connections after the Remote Desktop Services service was restarted
Cause: Per Microsoft KB2507353 (documented for Windows Server 2008/2008 R2), stopping or restarting the Remote Desktop Services (Terminal Services) service while keep-alive is enabled can leave the TermDD driver in an inconsistent state.
Reboot the server to restore RDP functionality, and avoid manually stopping or restarting the Remote Desktop Services service while keep-alive is enabled — reboot the host instead when a restart is required.
Registry limits seem to be ignored or wildly off
Cause: The value was entered in the wrong unit. Under the Terminal Services policy key the limits are stored in milliseconds, so 15 (meant as minutes) is treated as 15 milliseconds.
Re-enter the limits as milliseconds (15 minutes = 900000, 1 hour = 3600000), or set them through Group Policy where you pick a duration from a dropdown and avoid the unit mistake entirely.
Collection limits are overridden by Group Policy
Cause: Both a session collection default and a Group Policy session-limit setting exist, and Group Policy takes precedence over the deployment/collection configuration.
Decide on one primary method. Either remove the conflicting Group Policy setting so the collection default applies, or manage the limits centrally through Group Policy and leave the collection values unset.
Frequently asked questions
What is the difference between an idle and a disconnected RDP session?
An idle session is still connected but has received no input for a while; a disconnected session has lost or closed its connection while the session keeps running on the server. They are governed by separate limits — *Set time limit for active but idle sessions* (MaxIdleTime) and *Set time limit for disconnected sessions* (MaxDisconnectionTime).
Do RDP session timeout changes require a reboot?
No. After changing the policy or registry value, run gpupdate /force and have users reconnect or log off and back on. The new limits apply on the next connection — no server reboot is needed.
How is keep-alive different from a session timeout?
Session timeouts end sessions that are idle, over their active limit, or disconnected. Keep-alive does the opposite: it makes the server check session state at a set interval so a session that is genuinely in use isn't mistaken for a dead connection and dropped by firewalls or load balancers.
Where do I set RDP timeouts for a full RDS deployment versus a standalone server?
On a standalone server, use Group Policy (gpedit.msc) or the registry. In an RDS deployment, set the defaults on the collection via Server Manager (Collection > Tasks > Edit Properties > Session) or with Set-RDSessionCollectionConfiguration on the RD Connection Broker.
Why do my Group Policy limits override the collection settings?
Group Policy session-limit settings take precedence over the deployment/collection defaults, and Computer Configuration policies take precedence over User Configuration. To avoid conflicts, manage session limits with one primary method per environment.
What time unit does the registry use for RDP session limits?
Under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services, the session-limit values are REG_DWORD in milliseconds (15 minutes = 900000). The keep-alive interval, by contrast, is set in minutes.
