I've had luck with ZCS NE 5.0.8 setting an idle timeout of 10 minutes, which works great for logging out stale user sessions. Is it possible to change this for individual accounts, so I can have some user accounts with a longer timeout period, but still keep my general COS to 10 minutes?