Windows RDP session persistence and roaming profiles

RDP session persistence keeps your remote desktop session alive when the network drops, and roaming profiles keep a user's files and settings with them between sign-ins. This guide configures both on a Windows Admin RDP desktop: session time limits, keep-alive settings, a profile share, and folder redirection for machines that are not domain-joined.

Before you start

You need:

• An Admin RDP desktop with Administrator rights. Connect with mstsc /v:203.0.113.10:3389. See connect to your Admin RDP if this is your first connection.
• At least one local or domain user account that can sign in over RDP. Create Windows users with Remote Desktop access covers the account setup.
• A separate data disk if you want profiles off C:. Use added disk space on Windows shows how to bring a new volume online.
• For true roaming profiles, the machine must be joined to an Active Directory domain. On a standalone Admin RDP desktop you can get most of the benefit with folder redirection instead, covered below.

Configure RDP session persistence

Session persistence is controlled by session time limits. The defaults disconnect idle sessions and end disconnected sessions after a set period, which is the opposite of what you want for a desktop that should stay running.

Open gpedit.msc and go to Computer Configuration > Policies > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Session Time Limits. Set:

• Set time limit for disconnected sessions — Enabled, then Never.
• Set time limit for active but idle Remote Desktop Services sessions — Enabled, then Never.
• Set time limit for active Remote Desktop Services sessions — Enabled, then Never.
• End session when time limits are reached — Disabled.

You can apply the same settings from PowerShell without opening the editor:

$ts = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services'
New-Item -Path $ts -Force | Out-Null
Set-ItemProperty -Path $ts -Name MaxDisconnectionTime -Value 0 -Type DWord
Set-ItemProperty -Path $ts -Name MaxIdleTime          -Value 0 -Type DWord
Set-ItemProperty -Path $ts -Name MaxSessionTime       -Value 0 -Type DWord
Set-ItemProperty -Path $ts -Name fResetBroken         -Value 0 -Type DWord
gpupdate /force

A value of 0 means no limit. After gpupdate finishes, sign out and back in so the new policy applies to the session.

Keep disconnected sessions alive

Time limits stop the server from ending a session, but a flaky link can still drop the TCP connection. Keep-alive packets tell the client and server that the session is still wanted, and automatic reconnection brings the desktop back without a new logon.

In gpedit.msc, under Remote Desktop Session Host > Connections, set:

• Configure keep-alive connection interval — Enabled, interval 1.
• Configure Automatic Reconnection — Enabled.

The registry equivalents live under the Terminal Server key:

$ts = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server'
Set-ItemProperty -Path $ts -Name KeepAliveEnable   -Value 1 -Type DWord
Set-ItemProperty -Path $ts -Name KeepAliveInterval -Value 1 -Type DWord

KeepAliveInterval is in minutes. Restart the Remote Desktop Services service, or reboot, for the change to take effect.

Set up roaming profiles

Roaming profiles store the user's profile folder on a share and copy it to the local machine at logon. On a domain-joined Admin RDP desktop, create the share on the data disk first.

New-Item -Path 'D:\Profiles' -ItemType Directory
New-SmbShare -Name 'Profiles' -Path 'D:\Profiles' -ChangeAccess 'EXAMPLE\Domain Users'

Replace EXAMPLE with your NetBIOS domain name. On the NTFS side, give Creator Owner Full control on subfolders and Domain Users only List folder / read data on the root. Microsoft changes the recommended permission set from time to time, so check the current documentation for the exact ACLs.

Then set the profile path on each user. In Active Directory Users and Computers, open the user, go to the Profile tab, and enter:

\\203.0.113.10\Profiles\%username%

Or do it from PowerShell:

Set-ADUser -Identity deploy `
  -ProfilePath '\\203.0.113.10\Profiles\deploy' `
  -HomeDirectory '\\203.0.113.10\Profiles\deploy' `
  -HomeDrive 'H:'

The folder is created on the user's first logon. If the share is unreachable, Windows falls back to a temporary profile — see the troubleshooting section.

Redirect folders on a standalone desktop

A workgroup Admin RDP desktop cannot use AD roaming profiles. The practical alternative is to move the known folders to the data disk and link them back with junctions, so the user sees Documents, Desktop and Downloads in the usual place while the bytes live on D:.

Sign the user out, then run this as Administrator. Change deploy to the account name.

mkdir D:\Users\deploy\Documents
robocopy "C:\Users\deploy\Documents" "D:\Users\deploy\Documents" /E /MOVE
rmdir "C:\Users\deploy\Documents"
mklink /J "C:\Users\deploy\Documents" "D:\Users\deploy\Documents"

Repeat for Desktop, Downloads, Pictures and any other folder the user cares about. The mklink /J command creates a directory junction, which applications treat as a normal folder.

Check it works

List sessions and their state:

query session
quser

A disconnected session should show state Disc and stay in the list. Reconnect with mstsc /v:203.0.113.10:3389 and confirm your open applications are still running.

Check the profile path from inside the session:

$env:USERPROFILE
Get-ChildItem '\\203.0.113.10\Profiles'

For a redirected folder, confirm the junction points at the data disk:

dir C:\Users\deploy | findstr /i "Documents Desktop"

Troubleshooting

• Session still ends after a disconnect — a local policy or another GPO is overriding the setting. Run gpresult /h C:\report.html and check which policy wins, then confirm MaxDisconnectionTime is 0 under HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services.
• User gets a temporary profile — the profile share is unreachable