---
locale: "en"
updated_at: "2025-10-24T16:12:40.276Z"
canonical: "https://www.isdecisions.com/en/userlock/docs/reference/access-policies/time-restriction"
---

# Time restrictions

Rules to control working hours or time quotas.

## Hours restrictions

Hour restrictions define specific timeframes where users can or cannot log on.

![](https://a.storyblok.com/f/122374/848x1020/9397b97f18/hours-restrictions-main-rules.png)

### Typical use cases

- Allow logon only during business hours.
- Block access on nights and weekends.
- Automatically disconnect inactive or long-running sessions.

### Key points to know

- You can configure timeframes as **Authorized** (only those hours allowed) or **Denied** (only those hours blocked).
- In case of **overtime**, you can either do nothing, force logoff, or lock the session. Forced logoff is disruptive (unsaved work lost), while lock is less intrusive.
- When the **Maximum session length** is reached, the session is automatically logged off after the delay set in **Logoff notification timeout**. Users can log on again immediately after being logged off.
- The **Logoff notification timeout** controls how long before forced logoff the [Time restriction logoff message](/userlock/docs/reference/server-settings/messages#admin-logoff) appears. Default is 1 minute. Best practice: allow enough time for users to save their work.
- Maximum locked time requires a password-protected screensaver and the setting [Consider screen saver time as locked time](/userlock/docs/reference/server-settings/general#sessions) enabled.

![](https://a.storyblok.com/f/122374/855x601/787cf1e965/hours-restrictions-advanced-rules.png)

### Configured policies

A list of all hour restriction policies is available in the **Access Policies** section, under the **Hour restrictions** page.

![](https://a.storyblok.com/f/122374/1676x695/23633b1798/hours-restrictions-table.png)

## Time quotas

Time quotas limit the **total connection time** a user can consume over a recurring period (day, week, month, etc.).

![](https://a.storyblok.com/f/122374/852x605/f1c8ab767f/time-quotas-main-rules.png)

### Typical use cases

- Limit daily VPN usage to a fixed number of hours.
- Apply different quotas per session type (e.g., workstation vs remote access).
- Restrict monthly logon time for temporary or contract staff.

### Key points to know

- You can define multiple quotas within the same policy by using different time periods or session types.
- When the quota is reached, users receive a notification and are logged off after the [Logoff notification timeout](/userlock/docs/reference/server-settings/general#time) global setting (configured in Server settings → General → Time).
- The [Time quota logoff period message](/userlock/docs/reference/server-settings/messages#admin-logoff) can be customized.
- The notification period does not count against the quota.
- Daily quotas reset at midnight → sessions that run past midnight can unexpectedly consume the next day’s quota. To avoid this, combine with a **Maximum session length** or M**aximum locked time**.

### Quota usage

- Quota consumption is visible in the [user dashboard](/userlock/docs/reference/activity#user-dashboard) → **Working Hours** tab.
  ![](https://a.storyblok.com/f/122374/1448x724/43e8c6d90e/time-quotas-consumed-time.png)
- Admins can reset or decrease consumed time manually.
  ![](https://a.storyblok.com/f/122374/587x546/254f394100/time-quotas-consumed-time-reduce.png)
- Quota usage can be displayed in the [Welcome message](/userlock/docs/reference/server-settings/messages#access-policies) (requires an [Alerts & notifications policy](/userlock/docs/reference/access-policies/notifications)).

### Example of Counterproductive Behavior

- A daily quota of 8 hours is set.
- Alice doesn’t work in the morning and logs on at 4:30 PM.
- She forgets to log off.
- At midnight, the counter resets to 0.
- By 8:00 AM, 8 hours are consumed (from previous day’s session), so the session is automatically logged off.
- At 8:30 AM, Alice tries to log on again but is denied, since the time quota is already consumed.

To prevent this scenario, consider configuring a **Maximum session length** or **Maximum locked time** (e.g., 8 hours) in the [Hours restriction](/userlock/docs/access-policies/time-restriction#hours-restrictions)  policy.

### Configured policies

A list of all time quota policies is available in the **Access Policies** section, under the **Time quotas **page.

![](https://a.storyblok.com/f/122374/1673x721/a59db9f847/time-quota-table.png)