>I have a web application running on a Windows 2003 Server and would like to increase the session timeout setting from the default of 20 minutes to 60 minutes.
>
>I went into the IIS manager on the server and right clicked on the web app and chose properties. I then went to the Home Directory tab, clicked the configuration button and then the Options tab and change the Session timeout property to 60 minutes.
>
>However, the timeout still remains at 20 minutes. I restarted the web app as well as restarted the server without success.
>

I really like this post by Scott Guthrie - I must have referred to this link at least a dozen times by now. You'll want to read the comments, since he fills in the blanks you might have about how ASP.NET handles session and authentication timeouts.

http://weblogs.asp.net/scottgu/archive/2005/11/08/430011.aspx