# Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)

Necessity: This setting determines the amount of idle time that must pass in a Server Message Block (SMB) session before the session is automatically disconnected. If a client session remains idle for longer than the configured time, the server disconnects it. This mitigates the risk of an unauthorized user gaining access to a system via an abandoned, authenticated session, thereby preventing potential data tampering or lateral movement. Auditing and Remediation: The audit script checks the current value of the 'autodisconnect' setting in the Windows Registry, which controls this behavior. The remediation script directly modifies this registry value to align with the desired security policy. Recommended State Rationale: The goal is to minimize the window of opportunity for session hijacking. Basic ([15, 15]): This value aligns with CIS benchmarks, providing a baseline level of protection by ensuring idle sessions are terminated after 15 minutes. Moderate ([10, 10]): This reduces the exposure time by a third, offering enhanced security for environments where the risk of session takeover is more significant, without being overly disruptive. Strict ([5, 5]): This provides the most aggressive protection by disconnecting sessions after only 5 minutes of inactivity. It is best suited for high-security environments where unattended sessions pose a critical risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[15,1]` |
| **Moderate** | `[10,1]` |
| **Strict** | `[5,1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script to query the REG_DWORD value 'autodisconnect' under the registry key 'HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters'. The script must output only the numerical data of this value.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument representing the number of minutes. The script must set the REG_DWORD value 'autodisconnect' under the registry key 'HKLM:\System\CurrentControlSet\Services\LanManServer\Parameters' to this argument. The script must return '$true' upon success and '$false' on failure.

