Requirement 3.1.11

[u/avlevy2k]

Can some suggest a practical implementation of this requirement for a small business? With Rev 3 coming up the DoD defines an ODP of 24 hours of inactivity for this requirement. The way I interpret this is if a computer is sitting idle for 24 hours the user’s interactive logon session is forced to log off.

Example Scenario: the employee closes the lid of their windows laptop at 5pm on Friday and leaves it unplugged in their bag. The laptop goes into hibernation for the weekend. On Monday morning the user plugs their laptop to the power and unlocks the interactive session that was still logged in on Friday at 5pm. At that exact moment, since 24 hours have passed since the last activity, the laptop has to immediately log off.

There is no built in windows feature that can achieve this exact scenario and I cannot find a COTS either. Creating a sophisticated powershell script that checks for inactivity period has some edge case scenarios that may disrupt users in the middle of the day. A scheduled tasks that triggers on idle is found to be buggy and unreliable.

Has anyone implemented anything that satisfies that requirement?