Our SharePoint 2013 site will not log users out unless the browser is completely closed. We are using NTLM authentication but the site is hosted, so it is external accessible. We are afraid users will leave the browser open and their session/login will remain active indefinitely if the browser is not closed.

Can you let me know how I can force the session to logout after 30 minutes of inactivity?

  • Will the user be promted for his credentials on logon? – TGlatzer Mar 17 '13 at 14:56
  • Yes. We do not want the auto login. – user15652 Mar 17 '13 at 16:41

Try this in powershell:

$sts = Get-SPSecurityTokenServiceConfig
$sts.WindowsTokenLifetime= (New-Timespan -Minutes 30)
$sts.LogonTokenCacheExpirationWindow = (New-Timespan -Minutes 30)
| improve this answer | |
  • Thanks for sending. I ran this and changed it to 1 minutes to quickly test but I am afraid it keeps the user logged in event after 10 minutes of inactivity. – user15652 Mar 17 '13 at 16:41
  • Are you using ADFS? – Amit Kumawat Mar 17 '13 at 16:48
  • did you test it from internet or in your organization network? – Amit Kumawat Mar 17 '13 at 16:51
  • We are using Active Directory. It was tested from external. – user15652 Mar 17 '13 at 17:49
  • Even though you were testing externally, was the site in the user's Trusted Sites or Local Intranet zones? – Danny Jessee Mar 17 '13 at 23:06

From the server side, you cannot assure a user session is killed impermanently, when using NTLM or(kerberos). While you can kill cookies and the user's current session, from the web app perspective, the user's OS and web browser work against you. Depending on the browser and OS config, they users' passwords will be cached and automatically re-submitted as soon as your web server sends over the HTTP Authenticate header. If the machine is NOT domain joined, killing the browser window may kill the session. IF the machine is domain joined, the OS does the caching and cannot be defeated.

Your only option to stop the SSO from doing its job is to use forms based auth.

| improve this answer | |
  • Killing the browser does kill the session so you are right on with that. The machines are not domain joined. We tried fba but we were having to add users twice for ntlm and fba accounts because fba logs in with upn and shows users request as upn instead of display name as it does when auth using ntlm so thinks like exchange and lync does seem to flow as well when logging in with ntlm. Thoughts? Anything we are missing? – user15652 Mar 18 '13 at 3:02
  • Any ideas on this? Any assistance would be appreciated. – user15652 Mar 19 '13 at 13:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.