# Ensure 'Microsoft network server: Amount of idle time required before suspending session' is set to '15 or fewer minute(s)

Necessity: This setting determines the period of inactivity before an SMB session is automatically disconnected. Leaving idle sessions open indefinitely increases the risk of session hijacking. If an attacker gains control of a workstation where a user is authenticated to a server, they can leverage that open session to access server resources. Automatically suspending idle sessions reduces the window of opportunity for such attacks. Auditing and Remediation: The audit script reads the 'autodisconnect' REG_DWORD value from the registry, which controls the session timeout in minutes. The remediation script directly modifies this registry value to enforce the desired timeout period. Recommended State Rationale: The recommendation is for 15 or fewer minutes. A lower value is more secure. Basic ([lower bound, 15]): This aligns with CIS benchmarks, providing a reasonable balance between security and user convenience, preventing premature session termination during brief work pauses. Moderate ([lower bound, 10]): This offers enhanced security by shortening the exposure window, suitable for environments with sensitive data. Strict ([lower bound, 5]): This highly secure setting is recommended for high-risk environments. It aggressively terminates idle sessions to minimize the opportunity for an attacker to hijack an authenticated connection, though it may impact workflows involving long pauses.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `[15,1]` |
| **Moderate** | `[10,1]` |
| **Strict** | `[5,1]` |
| **Type** | `RANGE` |

## Audit Script Working

PowerShell script to query the registry value 'autodisconnect' at 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters'. The script must output only the numerical value. If the value is not configured, the script should return the system default of '15'.

## Remediation Script Working

PowerShell script that accepts a single numerical command-line argument. The script must set the REG_DWORD value 'autodisconnect' at 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters' to the provided argument. It must return '$true' on success and '$false' on failure.

