Restrict the Allowed Logon Time for Local Users on Windows

The Parental Controls feature in Windows 7 and 8 can be used to limit the allowed logon hours for local user accounts. On Windows 10 and 11, a similar parental control feature (called Microsoft Family Safety) is only available for Microsoft (cloud) accounts. However, you can use built-in tools in Windows to restrict specific local users from logging on to a computer at specific hours and days,

For example, you might want to prevent some local users from logging on to Windows at any time except when allowed (most likely, you are reading this post because you want to limit the time your children spend on the computer 😉 ).

For example, I want to restrict the allowed logon time for a specific Windows user on weekdays from 8:00 to 09:00 and 17:00 to 18:00, and on weekends from 11:00 to 14:00. It is not possible to configure the login time limits using the Windows GUI. However, you can use the net user CLI command with the /times parameter.

Command syntax:

net user <login> /time:<allowed-time>

For my scenario, where I need to allow more than one allowed login time per day, the command would look like the following:

net user benedikt /times:M-F,8:00-9:00,17:00-18:00;Sa-Su,11:00-14:00

If a user attempts to log into a computer outside of the allowed hours, the following message will appear:

Your account has time limit restrictions that prevent you from signing in at this time. Please try again later.

List the current ‘Logon hours allowed’ settings:

net user benedikt

Remove all user logon time restrictions:

net user benedikt /time:all

If the user’s allowed hours for working on the computer have expired, you may want to disconnect the user or lock a session. After the logon time expires, the user session is not locked or disconnected by default.

1. Open the Local Group Policy Editor (gpedit.msc) and go to User Configuration -> Administrative Templates -> Windows Components -> Windows Logon Options
2. Enable the policy Set Action to take when logon hours expire.
3. Depending on your needs, in the policy settings, select the action you want to take when the allowed work hours expire. It could be Lock, Logoff, or Disconnect. It is better to lock a session to prevent the user from losing unsaved documents.

Now, when the user has one minute left to work, they will be notified and the session will be locked:

Sign-in time restrictions
Your computer will be locked in 1 minutes due to sign-in time restrictions.

So, we covered how to enforce logon time limits and force a user to log out when they exceed a time limit. This is how you can enable some basic parental controls on Windows and limit the amount of time that your children can spend on the computer.

In an Active Directory, the allowed logon hours and days can be enabled in the account settings in the ADUC snap-in.