GPO to log off locked user sessions after 10 minutes

There is no built-in Windows 10/11 GPO that logs off a local Fast User Switching session after it has remained locked for 10 minutes; use a session-aware Windows service or endpoint-management agent rather than an ordinary delayed scheduled task.

Why the available GPOs do not meet this requirement

• Interactive logon: Machine inactivity limit only locks an inactive workstation; it does not sign out the user. Its path is: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options ^1^
• The policies under: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits apply to Remote Desktop Services time limits. Microsoft explicitly states that idle-session limits do not apply to console sessions, so these policies do not cover staff using the PC locally. ^2^
• Locking and signing out are different Winlogon states. Locking leaves the user’s applications running; logging off terminates the processes associated with that logon session. ^3^

Recommended implementation

Deploy or develop a signed Windows service that runs as LocalSystem and maintains lock state separately for every interactive session:

1. Receive session-change notifications for lock, unlock, logon, logoff, and session termination.
2. On a lock notification, record:
   • WTS session ID
   • user/session identity
   • lock timestamp
   • a unique timer generation
3. Start a 10-minute timer for that session.
4. Cancel that timer when the same session unlocks or logs off.
5. When the timer expires, verify that:
   • the session still exists;
   • it is the same session originally observed;
   • no unlock occurred after that lock;
   • it has remained continuously locked for 10 minutes.
6. Log off that specific session through the session-management API.

WTSLogoffSession accepts a session ID, requires Reset permission for another user’s session, and can be checked synchronously for completion. ^4^

However, its documentation describes Remote Desktop Services sessions and does not explicitly confirm Windows 10/11 Pro local-console and Fast User Switching behavior. Before production deployment, validate the helper on both operating systems for:

• the current locked console session;
• a background Fast User Switching session;
• lock → unlock within 10 minutes;
• lock → unlock → lock again;
• sleep/resume during the timer;
• service or computer restart;
• multiple simultaneously signed-in users.

This is not a ready-made GPO configuration: it requires a tested service/management agent. Avoid presenting an unvalidated script as equivalent.

Why a lock-event scheduled task is not sufficient

Windows records workstation lock and unlock as Security events 4800 and 4801. ^5^ Task Scheduler can start a task from an event and delay execution—for example, PT10M means ten minutes. ^6^

That design still has significant problems:

• Event fields such as Logon ID or session name must not be assumed to be a numeric WTS session ID.
• A delayed task from the first lock can run after an unlock and second lock, incorrectly logging off a session that has only just been relocked.
• Sleep, reboot, event-log rollover, simultaneous sessions, and session-ID reuse require persistent correlation logic.
• logoff.exe is not a suitable universal action: Microsoft states that it cannot log off a console session. ^7^

A scheduled task is therefore appropriate only for launching or monitoring a session-aware helper, not as the complete solution.

GPO deployment

After validating the service on a pilot group:

1. Copy its signed installer and files to a read-only computer-accessible share.
2. In Group Policy Management, edit a GPO linked to the shared-PC computer OU.
3. Go to: Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks
4. Create an Immediate Task (At least Windows 7) that:
   • runs as NT AUTHORITY\SYSTEM;
   • runs whether a user is logged on or not;
   • uses Run with highest privileges;
   • installs or updates the service silently.
5. Apply it first to a limited device group, then verify service state and logoff behavior before wider rollout.

Microsoft documents this SYSTEM/elevated Group Policy Preferences deployment pattern for Windows 10/11 packages. ^8^

Warning: forced logoff terminates applications and can discard unsaved work. Display an organizational warning before enabling enforcement, and consider a longer timeout if users may legitimately leave unsaved work open.

References

1. Policy CSP - LocalPoliciesSecurityOptions
2. Policy CSP - ADMX_TerminalServer
3. Winlogon States
4. WTSLogoffSession function (wtsapi32.h)
5. Appendix L: Events to monitor
6. EventTrigger.Delay property
7. logoff
8. Onboard Windows 10 devices and Windows 11 using Group Policy