Set idle time
Automatically log off inactive sessions after a defined idle period to improve security and optimize resource usage.
Idle sessions are a common security and productivity concern, as they can expose sensitive data when users leave workstations unlocked.
UserLock can automatically log off idle user sessions after a specified duration.
This guide shows how to configure UserLock and Windows to enforce logoff after 20 minutes of inactivity for members of a specific Active Directory group.
Make sure the following prerequisites are met on all target computers:
✅️ The UserLock Desktop Agent is installed.
✅️ The screen saver is protected by password using the Windows option “On resume, display logon screen”. You can easily define this setting for all users through Microsoft Group Policies.
In the UserLock console, go to ⚙️ Server settings ▸ General.
Enable the option “Consider screen saver time as locked time.”
This ensures UserLock counts screen saver duration as session lock time.)
Restart the UserLock Agent Service (
ULAgentService) on all target computers.
)
)
)
)
Note
Important:
If this step is skipped, the screen saver will trigger a “Lock” event in UserLock but the session will not actually be locked (the user can cancel it during the 5-second grace period).
In the console, open Access Policies from the top menu.
Edit an existing policy for your AD group, or create a new access policy (see Create an access policy for detailed steps).
In the policy editor, select the Hours Restrictions section.
Set the option Maximum locked time to Limited to, then enter the number of minutes of inactivity allowed after the screen saver starts.
)
)
)
)
)
Setting | Value |
|---|---|
Screen saver delay | 10 minutes |
Maximum locked time | 10 minutes |
Result | ➡️ Logoff after 20 minutes of total inactivity |
Every session of a user under this policy will be closed after 20 minutes of inactivity (10 minutes before the screen saver starts, plus 10 minutes of locked time).
Before the session closes, a logoff dialog box appears in the user’s session.
By default, the notification appears 1 minute before logoff.
If you modified the logoff notification timeout of the access policy, the dialog box appears accordingly.
See the Hours Restrictions reference section for more details on this access policy.