ASD ISM 0853 Terminate interactive user sessions and restart workstations at least daily
What it says
Interactive user sessions are terminated and workstations are restarted at least daily.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishEvery interactive user session on a workstation is ended, and the workstation itself is rebooted, at least once every day so nothing runs indefinitely.
This control asks for two things on every workstation: each interactive user session (a person logged in at the console or over a remote desktop) is ended at least once a day, and the workstation itself is restarted at least once a day. It matters because a session that never ends and a machine that never reboots become a stable base for an attacker. Malicious code that lives only in memory, a hijacked logon token, or a leftover process from a compromised application can persist for weeks if the machine is simply locked overnight rather than logged off and restarted. A daily logoff clears the user's in-memory credentials and open handles; a daily reboot clears the operating system's memory state and forces everything to start clean from disk. Together they turn a long-lived foothold into something that has to be re-established every day, which is far more likely to be noticed and far more work for an adversary.
Free. Save your status, tasks and notes.
Why it matters
If sessions are left running and workstations are never restarted, memory-resident malware, stolen logon tokens and rogue processes can persist indefinitely on the endpoint. An attacker who gains access once keeps that access for as long as the machine stays up, and the organisation loses a cheap, routine opportunity to break that persistence every 24 hours.
How to implement
The endpoint management team configures a policy in the organisation's device management platform (for example Group Policy or Intune for Windows, Jamf or an MDM profile for macOS) that forces interactive user sessions to end after a maximum duration of 24 hours or at a fixed daily time, applied to every workstation in scope.
The endpoint management team creates a scheduled restart task on all workstations that reboots the device at least once every 24 hours, choosing a time outside core working hours and enabling a visible countdown so users can save open work before the restart.
The desktop support team configures the same forced logoff and restart on remote desktop hosts and virtual desktop pools where staff hold interactive sessions, using the session-limit settings of the remote access platform so that disconnected or idle sessions are terminated rather than left running.
The endpoint management team builds an uptime and session-age report from the management platform or monitoring agent that lists any workstation with uptime over 24 hours or a session older than 24 hours, and assigns the desktop team to investigate and remediate each one within the next business day.
The IT service desk publishes a short notice to staff explaining the daily logoff and restart time, how much warning they will receive, and how to save work beforehand, and records any approved exception (with an expiry date) in the change or exception register.
Keep it running
In practice this is enforced centrally rather than left to users. The endpoint management platform (Group Policy, Intune, Jamf or similar) sets a maximum interactive session length and schedules a forced logoff and restart, usually outside core hours, with a short countdown and warning so users can save work. Workstations that are powered off overnight satisfy the restart requirement naturally, but machines that are locked and left on, docked laptops, and shared or kiosk workstations are the ones that need the scheduled enforcement.
Day to day, the desktop team watches for machines whose uptime exceeds 24 hours or whose session age exceeds the limit, and investigates why the scheduled task did not fire (device offline at the scheduled time, task disabled, policy not applied). Exceptions for long-running workloads should be rare, documented and time-boxed, because each one is a machine where the daily clean-out is not happening.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the policy or configuration profile that enforces the maximum interactive session length and the scheduled daily restart on workstations.
Look at
Look at the session limit value and the restart schedule, and confirm the policy is assigned to all workstation groups, including remote desktop and virtual desktop hosts.
Good evidence
A centrally managed policy ends sessions at or before 24 hours and reboots every workstation at least daily, with no workstation group left out.
- Check 2 of 5What an auditor asks for
Ask for
Ask for a current uptime report across the workstation fleet from the management platform or monitoring tool.
Look at
Look at the number of devices reporting uptime greater than 24 hours and how long they have been in that state.
Good evidence
Almost no devices exceed 24 hours uptime, and those that do are either recently offline or listed as approved exceptions.
- Check 3 of 5What an auditor asks for
Ask for
Ask for event logs or management platform logs showing forced logoffs and scheduled restarts over the past month for a sample of workstations.
Look at
Look for a logoff and a restart event on each sampled workstation for each day it was in use, and check for gaps or repeated task failures.
Good evidence
Each sampled workstation shows a daily session termination and restart with no unexplained gaps.
- Check 4 of 5What an auditor asks for
Ask for
Ask how remote desktop and virtual desktop sessions are terminated daily, and request the session-limit settings for those platforms.
Look at
Look at whether disconnected and idle sessions are ended within 24 hours and whether the hosts themselves are restarted or the virtual desktops reset daily.
Good evidence
Remote and virtual sessions are subject to the same daily termination as physical workstations, not left to run indefinitely.
- Check 5 of 5What an auditor asks for
Ask for
Ask for the exception register covering any workstation excluded from the daily logoff or restart.
Look at
Look at the reason recorded for each exception, who approved it, and whether it has an expiry or review date.
Good evidence
Exceptions are few, justified, approved by a named person and time-limited, rather than open-ended exclusions.
Mappings
Closest match in ISO/IEC 27001: A.8.1, Protection of user endpoint devices, which this control partially meets.
ISO/IEC 27001: 1 mapping
This control partially meets A.8.1.
ISM-0853 requires interactive user sessions to be terminated and workstations to be restarted at least daily to reduce persistence of processes, clear volatile state, and limit exposure from unattended sessions. ISO/IEC 27001:2022 Annex A 8.1 requires protection of user endpoint devices, which commonly includes hardening measures such as enforced logoff/lock, session timeouts, and restart policies. ISM-0853 is a specific operational endpoint-hardening practice, while Annex A 8.1 is broader and can be satisfied through multiple endpoint controls beyond daily restarts.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.