To set the session timeout in ASP.NET 4 on an Internet Information Server 7 (or 7.5) correctly, follow these steps:

• Application Pool: Advanced Settings => Process Model => Idle Time-out(minutes)
• Sites: whatever web needs to be set => ASP => Session Properties => Time-out     remember to Apply the change
• Sites: whatever web needs to be set => Configuration Editor => system.web/sessionState => timeout. Remember to Apply the change.
• Sites: whatever web needs to be set => Configuration Editor => system.web/roleManager => cookieTimeout. Remember to Apply the change.

Hope this helps.