Access policies

UserLock access policies are sets of rules that define how users can access the network. They allow organizations to enforce contextual security controls and multi-factor authentication (MFA) directly on Active Directory accounts, groups, and organizational units (OUs).

Published May 1, 2024

Why access policies matter

Access policies let administrators move beyond “all-or-nothing” network access. With UserLock, you can:

Enforce MFA for stronger authentication.
Apply contextual restrictions (time, geolocation, machine).
Limit the number of concurrent sessions.
Control access with permanent or temporary policies.
Generate alerts and notifications when rules are triggered.

This enables fine-grained control of user access while ensuring policies can adapt to exceptional situations (e.g., temporary access during leave, extended hours for special projects).

Types of policies

Permanent policies: Apply indefinitely until modified or deleted.
Temporary policies: Active only for a specified period. These can be used to allow exceptions (e.g., working outside usual hours) or to temporarily deny access (e.g., while on leave).

Useful resources

Temporary policies
Reference

Policy priority management

Because users may belong to several policies, UserLock applies a priority system to resolve conflicts based on the following criterias:

Policy type	Temporary policies always override permanent policies.
Target type	User policies override Group or OU policies.
Server-wide policy setting	Defines how to handle ties between equal-priority policies: Least restrictive (default): If at least one policy allows access, it is granted. Most restrictive: If any policy denies access, it is denied.

Priority levels (highest to lowest)

User temporary policy
Group/OU temporary policy
User permanent policy
Group/OU permanent policy

Examples of priority resolution

Temporary vs. Permanent

Alice is in a permanent group policy (“Everyone”) allowing 1 workstation session.
She is also in a temporary group policy (“Everyone”) allowing 3 sessions.
Result: The temporary rule applies → Alice can open 3 sessions.

Two permanent group policies

Bob is in a permanent group policy (“Everyone”) allowing 1 session.
He is also in another permanent group policy (“Group-A”) allowing 2 sessions.
Both rules are permanent group-level policies (same priority level).
Result: The applied rule depends on the server-wide policy (most restrictive = 1; least restrictive = 2).

Temporary vs. Permanent with least restrictive server policy

Carol is in a permanent group policy (“Group-A”) allowing 2 sessions.
She also is in a temporary group policy (“Group-B”) allowing 5 sessions.
Server is set to least restrictive → Carol can open 5 sessions.
If a temporary policy for “Group-A” authorizes 3 sessions, it overrides both → Carol can open 3 sessions during the temporary policy.

User vs. Group/OU

Alice has a permanent user policy allowing 2 sessions.
She is also in a permanent group policy allowing 1 session.
Result: The user policy wins → Alice can open 2 sessions.
Bob has a temporary user policy allowing 2 sessions.
He is also in a temporary group policy (“Group-A”) allowing 1 session.
Result: The user policy wins → Bob can open 2 sessions.

Synchronization with Active Directory

UserLock continuously tracks AD group and OU memberships to ensure policies are always up to date.

When applying restrictions, UserLock checks which policies apply to the user.

The membership list is refreshed every 5 minutes.
Creating or deleting a policy applies to active sessions within 5 minutes.
Changes to policies are applied without requiring users to reconnect.

👉️ Example: If an admin creates a new temporary policy to allow access outside normal hours, the user does not need to disconnect / reconnect to apply the modification.

Note

The Domain Users, Everyone, and Authenticated Users groups always include all users in the domain, even if specific accounts were removed from these groups. Microsoft also recommends never removing accounts from Domain Users, since it is the primary group.

Summary

UserLock access policies give administrators precise, flexible control over network access:

Apply MFA and contextual restrictions (time, location, machine, session limits).
Use permanent policies for baseline security, and temporary policies for exceptions.
Synchronization with AD ensures policies stay accurate and up-to-date.
Rules are applied immediately, with conflicts resolved by a clear priority system.

This framework ensures that user access remains both secure and adaptable to organizational needs.