Application Pool Timeout
If session variables are stored in the IIS worker process, that means that when the user begins navigating the site, IIS assigns them a session Id. Any session variables stored (like user session variables when the user logs in) are stored in the IIS worker process. The worker process belongs to an application pool and that application pool has a timeout setting with a default value of 20 minutes. IIS will recycle the IIS worker processes according to this timeout so that any one worker process is not used to too long. If the worker process is shutdown or killed for any reason, the session information will be lost. This means that the user who is logged in with session variables defined at login, will no longer have those session variables and will be logged out.
The settings for the application pool can be found by clicking Properties (IIS 6) or Advanced Settings (IIS 7.5) on the application pool that the application is assigned to. Ensure this value is set to the timeout of your session, at a minimum, to ensure that all sessions persist for the entire session timeout period.