diff --git a/src/main/java/de/ph87/tools/session/AbstractSession.java b/src/main/java/de/ph87/tools/session/AbstractSession.java
index 5916bc8..1d981bd 100644
--- a/src/main/java/de/ph87/tools/session/AbstractSession.java
+++ b/src/main/java/de/ph87/tools/session/AbstractSession.java
@@ -47,22 +47,18 @@ public abstract class AbstractSession implements IWebSocketMessage {
 
   protected AbstractSession(@NonNull final User user) {
     this.owner = user;
-    this.join(user);
   }
 
   public void join(@NonNull final User user) {
     synchronized (uuid) {
       users.add(user);
       touch();
-      user.join(this);
     }
   }
 
   public void leave(@NonNull final User user) {
     synchronized (uuid) {
       users.remove(user);
-      touch();
-      user.leave(this);
     }
   }
 
diff --git a/src/main/java/de/ph87/tools/session/AbstractSessionController.java b/src/main/java/de/ph87/tools/session/AbstractSessionController.java
index c2f61a6..ad94565 100644
--- a/src/main/java/de/ph87/tools/session/AbstractSessionController.java
+++ b/src/main/java/de/ph87/tools/session/AbstractSessionController.java
@@ -39,9 +39,15 @@ public abstract class AbstractSessionController<SESSION extends AbstractSession>
 
   @Scheduled(timeUnit = TimeUnit.MINUTES, initialDelay = 5, fixedRate = 5)
   public void cleanUp() {
-    final ZonedDateTime deadline = ZonedDateTime.now().minusDays(1);
+    final ZonedDateTime deadline = ZonedDateTime.now().minusDays(30);
     synchronized (sessions) {
-      sessions.removeIf(session -> session.getLastAccess().isBefore(deadline));
+      sessions.stream().filter(session -> session.getLastAccess().isBefore(deadline)).forEach(this::delete);
+    }
+  }
+
+  private void delete(@NonNull final SESSION session) {
+    for (final User user : session.getUsers()) {
+      user.leave(session);
     }
   }
 
@@ -61,9 +67,7 @@ public abstract class AbstractSessionController<SESSION extends AbstractSession>
       sessions.add(session);
     }
 
-    applicationEventPublisher.publishEvent(session);
-    applicationEventPublisher.publishEvent(user);
-    return toDto(session, user);
+    return join(session, user);
   }
 
   @PostMapping("canAccess")
@@ -89,7 +93,14 @@ public abstract class AbstractSessionController<SESSION extends AbstractSession>
       log.error("Wrong password: user={}, session={}", user, session);
       throw new ResponseStatusException(HttpStatus.FORBIDDEN);
     }
+    return join(session, user);
+  }
+
+  @NonNull
+  private AbstractSessionDto join(@NonNull final SESSION session, @NonNull final User user) {
     session.join(user);
+    user.join(session);
+    log.info("User joined Session: user={}, session={}", user, session);
     applicationEventPublisher.publishEvent(session);
     applicationEventPublisher.publishEvent(user);
     return toDto(session, user);
@@ -124,6 +135,7 @@ public abstract class AbstractSessionController<SESSION extends AbstractSession>
     final User user = userService.getByPrivateUuidOrThrow(userUuid);
     final SESSION session = getSessionByUuid(sessionUuid);
     session.leave(user);
+    user.leave(session);
     applicationEventPublisher.publishEvent(session);
     applicationEventPublisher.publishEvent(user);
   }
diff --git a/src/main/java/de/ph87/tools/user/User.java b/src/main/java/de/ph87/tools/user/User.java
index 39df073..9c10bd9 100644
--- a/src/main/java/de/ph87/tools/user/User.java
+++ b/src/main/java/de/ph87/tools/user/User.java
@@ -48,9 +48,8 @@ public class User implements IWebSocketMessage {
   }
 
   public void leave(@NonNull final AbstractSession session) {
-    synchronized (privateUuid) {
+    synchronized (sessions) {
       sessions.remove(session);
-      touch();
     }
   }