---
locale: "en"
updated_at: "2025-10-27T14:10:11.443Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/getting-started/configuration-access-policy"
---

# Configure an access policy

Create rules controlling users’ logons and sessions.

This tutorial walks you through creating your first access policy using the configuration wizard.

🧪 For a **quick test**, we propose to deny access to a specific machine for a given user.

## 1. Open the policy wizard

1. In the UserLock console, go to **Access policies**.
2. Click on the **Add** button.
3. The policy wizard opens, guiding you step by step.

## 2. Select the target

1. You first need to select the **target type** on which the access policy will be applied. The target is an object of your Active Directory and can be a **user**, a **group **or an **organizational unit**.

🧪 For our quick test, click on **User**.
  ![](https://a.storyblok.com/f/122374/1342x657/e0fbab9e60/policy-wizard-target-type.png)
2. Search the **target**.
  ![](https://a.storyblok.com/f/122374/1314x598/ca2840d5fe/policy-wizard-target-search.png)
  🧪 For our quick test, make sure to select a target for which you know the login details.
3. If you know the exact account name, type it directly in the field and click **Continue**.
4. If you don’t know the exact name:
  - Enter at least **two characters** of the account name.
  - Click **Find**.
  - UserLock will run an **LDAP search** to list all matching accounts.
5. If the search takes too long or shows too many results, enter more characters to refine the search.
6. Once the correct account appears, select it and click **Continue**.

## 3. Define the duration

On the **Duration** step of the wizard, choose how long the policy should apply.

- **Permanent** → The rules have no time limit.
- **Temporary** → The rules apply for a **specific time period**. For more details about managing temporary policies and conflicts, see [Temporary policies (Reference)](/userlock/docs/reference/access-policies/temporary-policies).

🧪 For our quick test, select **Permanent**.

![](https://a.storyblok.com/f/122374/1136x641/096f8424d0/policy-wizard-duration.png)

## 4. Choose the policy type

You must now select the policy type. 

🧪 For our quick test, select **Machine restrictions**.

![](https://a.storyblok.com/f/122374/1347x831/1744b8f5fb/policy-wizard-policy-type-permanent.png)

*This step will be automatically bypassed if you started the policy wizard from a specific policy page.*

## 5. Configure the rules

> **Note**
>
> This step varies depending on the selected policy type. For more details, see the [Access policies references](/userlock/docs/reference/access-policies/).

🧪 For our quick test, we will configure a simple machine restriction.

1. Set the machine list to **Denied**.
2. Under the machine list, click the **Add** button.
3. Select by **Name**.
4. Enter the name of a machine you can access and where the Desktop agent is installed.
5. If you don't know the exact name, click on **Find** to search a machine from your Active Directory.
6. Select the **Workstation** and **Terminal** session types.
7. Click on **Continue** then **Save** the rules.
8. After saving the rules, the wizard automatically returns on the policy type step. The Machine restriction policy is checked to indicate a configuration has been set.
9. Exit the wizard by clicking the **Close** icon in the upper right corner.

![](https://a.storyblok.com/f/122374/1278x819/6eb209ffe3/workstations-denied-name-interactive.png)

## Next step

Once your first policy is created, continue with the next step: [Verify your setup](/userlock/docs/getting-started/verify-your-setup).