Unfortunately we're at Microsoft's mercy on this as we can't set an expiry on when it resets that the user last connected using WindowsAuthentication. I understand that it could be done in .NET 1.1 but not from 2.0 on.

I could try to force it to kill the cookie on logout (there is some code there from the previous developer with the comment that he had to check it in the future to see why it didn't work) but then you'd never be able to get logged in as another user (you click logout it kills the authentication, the page reloads, detects that the site is using Windows Authentication and logs you right back in).