Specify idle Timeout
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Vista
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Windows Remote Shell Description
This policy setting configures the maximum time in milliseconds remote shell will stay open without any user activity until it is automatically deleted. Any value from 0 to 0x7FFFFFFF can be set. A minimum of 60000 milliseconds (1 minute) is used for smaller values. If you enable this policy setting, the server will wait for the specified amount of time since the last received message from the client before terminating the open shell. If you do not configure or disable this policy setting, the default value of 900000 or 15 min will be used.
Registry
HKLM
Software\Policies\Microsoft\Windows\WinRM\Service\WinRS MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/RemoteShell/SpecifyIdleTimeout Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Specify idle Timeout
; State: Enabled
; Supported on: At least Windows Vista
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS]
"IdleTimeout"=dword:000dbba0More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IdleTimeout' -Value 900000 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/RemoteShell/SpecifyIdleTimeout
Data type: String
Value:
<enabled/>
<data id="IdleTimeout" value="900000"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS' -Name 'IdleTimeout' -Expected 900000 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IdleTimeout' -Value 900000 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS' -Name 'IdleTimeout' -Expected 900000 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Specify idle Timeout
# State: Enabled
# Supported on: At least Windows Vista
$path = 'HKLM:\Software\Policies\Microsoft\Windows\WinRM\Service\WinRS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'IdleTimeout' -Value 900000 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.