In IIS 6 (and other versions too afaik), there is a Session Timeout setting in Properties -> Home Directory Tab -> Configuration button -> Options tab. Looks like this:
And in the ASP.NET web.config there is a SessionState setting, looks like this:
<system.web>
<sessionState timeout="120" />
<!-- etc .. -->
</system.web>
Are they, by any chance, related? Do they set the same thing, or different things?
You should also consider Application Pool Idle Timeout. The settings for the application pool can be found by clicking Properties (IIS 6) or Advanced Settings (IIS 7.5) on the application pool that the application is assigned to.
Ensure this value is set to the timeout of your session, at a minimum, to ensure that all sessions persist for the entire session timeout period.
The reason that these two values are dependent on one another is because the session information is actually stored within the worker process of the application pool. That is to say, if the worker process is shutdown or killed for any reason, the session information will be lost.
