diff --git a/management/server/grpcserver.go b/management/server/grpcserver.go
index 0ee9e0715..c1e2c5cfd 100644
--- a/management/server/grpcserver.go
+++ b/management/server/grpcserver.go
@@ -177,6 +177,7 @@ func (s *GRPCServer) Sync(req *proto.EncryptedMessage, srv proto.ManagementServi
 		case update, open := <-updates:
 			if !open {
 				log.Debugf("updates channel for peer %s was closed", peerKey.String())
+				s.cancelPeerRoutines(peer)
 				return nil
 			}
 			log.Debugf("recevied an update for peer %s", peerKey.String())
@@ -198,18 +199,18 @@ func (s *GRPCServer) Sync(req *proto.EncryptedMessage, srv proto.ManagementServi
 		case <-srv.Context().Done():
 			// happens when connection drops, e.g. client disconnects
 			log.Debugf("stream of peer %s has been closed", peerKey.String())
-			s.peersUpdateManager.CloseChannel(peer.ID)
-			s.turnCredentialsManager.CancelRefresh(peerKey.String())
-			err = s.accountManager.MarkPeerConnected(peerKey.String(), false)
-			if err != nil {
-				log.Warnf("failed marking peer as disconnected %s %v", peerKey, err)
-			}
-			// todo stop turn goroutine
+			s.cancelPeerRoutines(peer)
 			return srv.Context().Err()
 		}
 	}
 }
 
+func (s *GRPCServer) cancelPeerRoutines(peer *Peer) {
+	s.peersUpdateManager.CloseChannel(peer.ID)
+	s.turnCredentialsManager.CancelRefresh(peer.ID)
+	_ = s.accountManager.MarkPeerConnected(peer.Key, false)
+}
+
 func (s *GRPCServer) validateToken(jwtToken string) (string, error) {
 	if s.jwtMiddleware == nil {
 		return "", status.Error(codes.Internal, "no jwt middleware set")
diff --git a/management/server/peer.go b/management/server/peer.go
index 49732421f..d3002c96f 100644
--- a/management/server/peer.go
+++ b/management/server/peer.go
@@ -96,8 +96,10 @@ func (p *Peer) Copy() *Peer {
 // MarkLoginExpired marks peer's status expired or not
 func (p *Peer) MarkLoginExpired(expired bool) {
 	newStatus := p.Status.Copy()
-	newStatus.LastSeen = time.Now()
 	newStatus.LoginExpired = expired
+	if expired {
+		newStatus.Connected = false
+	}
 	p.Status = newStatus
 }
 
diff --git a/management/server/turncredentials.go b/management/server/turncredentials.go
index 752376767..a9423ea71 100644
--- a/management/server/turncredentials.go
+++ b/management/server/turncredentials.go
@@ -63,18 +63,18 @@ func (m *TimeBasedAuthSecretsManager) GenerateCredentials() TURNCredentials {
 
 }
 
-func (m *TimeBasedAuthSecretsManager) cancel(peerKey string) {
-	if channel, ok := m.cancelMap[peerKey]; ok {
+func (m *TimeBasedAuthSecretsManager) cancel(peerID string) {
+	if channel, ok := m.cancelMap[peerID]; ok {
 		close(channel)
-		delete(m.cancelMap, peerKey)
+		delete(m.cancelMap, peerID)
 	}
 }
 
 // CancelRefresh cancels scheduled peer credentials refresh
-func (m *TimeBasedAuthSecretsManager) CancelRefresh(peerKey string) {
+func (m *TimeBasedAuthSecretsManager) CancelRefresh(peerID string) {
 	m.mux.Lock()
 	defer m.mux.Unlock()
-	m.cancel(peerKey)
+	m.cancel(peerID)
 }
 
 // SetupRefresh starts peer credentials refresh. Since credentials are expiring (TTL) it is necessary to always generate them and send to the peer.