The User Security page in TimeStar is used to review the security group assignment of a particular employee. Adjustments to an employee’s security group due to promotion or other organizational changes can be made here.
Navigating To The User Security Page
- In the Main Navigation menu, open the Security Setup folder.
- Click on the User Security page.
Reviewing The User Security Page
- User Security:
- Provides a drop-down containing all the user accounts generated within TimeStar.
- Properties:
- Contains various properties of the user selected.
- Note: Changes here are typically not recommended as they will be overwritten based on security group assignment. The areas of exception are listed below.
- A. Reset the employees login password.
- B. Force employee to change their password at next login.
- C. Email Address – This is the email address that any alerts or requests will be sent to.
- * At times the Username may need to be adjusted if you encounter a duplication.
- Company Memberships:
- The employee’s TimeStar company assignment.
- Group Memberships:
- The employee’s security group assignment. This controls the access and functionality of the employee while using TimeStar.
Changing An Employee’s Security Group Assignment
There are various reasons why an employee may need their security group updated within TimeStar. These typically occur when an employee is promoted and now manages employees (change to “Managers” or “Supervisor”) or no longer is required to clock in/out (change to “Non-punching”), etc. This section reviews the steps for adjusting an employee’s security group assignment, using the user security page.
In the steps below, we will promote an employee to have Supervisor Permissions.
- Select Employee – Choose the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
- Group Memberships – Locate the group memberships selector box (section 4 noted above). Remove the current group located on the left-hand side using the right-arrow
button:
- Group Memberships – Select the new group from the right-hand side and use the left-arrow
button to assign a new security group:
- Save Changes – Make sure to click the Save
button to save the changes.
Impersonate Employee
To impersonate an employee, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the Impersonate 
button. This will generate a new tab, with the employee’s permissions.
Changing Password As An Employee
To update your current password to a new password, follow the steps below:
1. Once logged in, click the ACCOUNT menu item in the upper right of TimeStar
2. Click the box to put a check next to Change Password?
3. Enter your Current Password
4. Enter your New Password
5. Confirm New Password
6. Click Save
Changing Password As An Supervisor
To Change the Password for an employee that you supervise, follow the steps below:
1. Once logged in, click the ACCOUNT menu item in the upper right of TimeStar
2. Select the SUPERVISEE PASSWORDS tab
3. Enter the New Password
4. Enter again to Confirm Password
5. Click Save
6. If employee should then update their password to something unique, have them follow the steps under the Changing Password As An Employee section above.
Changing Password As An Administrator
To Change the Password for any employee in the system, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click 
3. In the box that appears:
- Enter the new password for the employee. This is normally a default password that the employee will change when they next log in.
- Confirm the password.
- Click
4. If not assigning a password that the employee will continue to use, update the Force User to Change Password at Next Login field to Yes.
5. Click
If the Force User to Change Password at Next Login was set to yes, the next time the employee logs in with the given new password they will be prompted to create a new unique password to log in with.
Restricting Who A User Can See
Administrators can restrict which employees a user will see in the employee dropdown by setting filters on the employee’s User Security page.
To limit the employees that the user should have access to, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the RESTRICTIONS tab.
3.
- A. If Filters have already been established, select the appropriate filter name in the Filter dropdown field. In the example below, I have assigned a filter that was saved previously to only have those employees in the IT Security Department as their default Department visible.
- B. To create a new filter, click on the filter icon
and set up your filter.
For more information on how to set up filters, please see the Using Filters In TimeStar page.
4. Click to apply the filter.
Restricting A Users Pay Type Access
Administrators can restrict pay types that an individual user may access by setting restrictions on the User Security page. These settings can also be set through Group Security settings to apply to a group of employees. In addition, Group Restrictions and User Restrictions may be used together.
To limit the pay types that the employee should have access to, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the RESTRICTIONS tab.
If the Pay Type Access Restrictions field is empty as shown below, no User Security restrictions are currently in place for the employee.
4. In the Pay Type Access Restrictions section, move the pay types the employee should be allowed to access to the left. In the example below, Doris will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes.
5. Click to apply the restrictions.
Restricting A Users Future Pay Type Access
Administrators can restrict pay types that an individual user may access on a future date by setting restrictions on the User Security page. These settings can also be set through Group Security settings to apply to a group of employees. In addition, Group Restrictions and User Restrictions may be used together.
To limit the pay types that the employee should have access to on a future date, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the RESTRICTIONS tab.
If the Pay Type Access Restrictions field is empty as shown below, no User Security restrictions are currently in place for the employee and they will have access to all pay types unless otherwise restricted by their Group Security assignment.
4. In the Restrict Future Pay Types section, move the pay types the employee should not be allowed to access to the left. Pay Types they are allow to enter are left on the right. In the example below, Doris will be allowed to access all of the Pay Types in the system, up to and including whatever the current date is, but entering any time after today’s date will be restricted to Personal Leave, Sick Leave, and Vacation earning codes.
5. Click to apply the restrictions.
Restricting A Users Current & Future Pay Type Access
Administrators can restrict pay types that an individual user may access up to and including today’s date as well as restricting pay type access on a future date by setting restrictions on the User Security page. These settings can also be set through Group Security settings to apply to a group of employees. In addition, Group Restrictions and User Restrictions may be used together.
To limit the pay types that the employee should have access to up to today’s date as well as future dates, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the RESTRICTIONS tab.
4. Set the restrictions for the employee.
- A. In the Pay Type Access Restrictions section, move the pay types the employee should be allowed to access to the left. In the example below, Doris will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes.
- B. In the Restrict Future Pay Types section, move the pay types the employee should not be allowed to access to the left. Pay Types they are allow to enter are left on the right based upon the earnings they allowed access to in the Pay Type Access Restrictions section.
In the example below, Doris will be allowed to access the Personal Leave, Regular, Sick Leave, and Vacation earning codes, up to and including today’s date, but entering any time after today’s date will be restricted to Personal Leave, Sick Leave, and Vacation earning codes and Regular hours will not be accessible.
5. Click to apply the restrictions.
Restricting A Users Org Level Access
To restrict the organization levels the employee will have available for selection, establish those restrictions on the User Security page. These settings can also be set through Group Security settings to apply to a group of employees. In addition, Group Restrictions and User Restrictions may be used together.
To limit the org level items that the employee should have access to, follow the steps below:
1. Select Security Setup > User Security from the Navigation tree.
2. Select the employee who requires modification via the master employee drop-down:
Verify that the Select User, Username, and Employee fields all match the employee you are modifying.
3. Click the RESTRICTIONS tab.
If no organization levels are selected in the Org Level Access Restrictions field, no User Security org level restrictions are currently in place for the employee.
In the Org Level Access Restrictions section, we have several options that can be set.
- Company: If you have multiple companies built within your system that you must toggle between, select the appropriate company the employee belongs to. This is very rare as most organizations can use org levels within a single system to define separate companies.
- Depth: Select the org level depth you would like to restrict. Company ABC Glass has four org levels. Company, which has Locations within it. Each Location has Departments within it. Finally, each Department will have a list of Jobs associated with it.
- Permissions: There are four permissions that can be selected: restrict from all items, home items only, disallow all access, selected org level items.
-
- All Items – for the organization level depth selected, all of org level items will not be available for the user.
- Home Items Only – For the organization level depth selected, the user will only be able to see the employee’s home organization levels and will not be able to override organization levels to any value.
- Disallow All Access – The user will not see this organization level depth for any Daily Procedures records or on the Employee Information – Groups page. The organization level will display on reports.
- Selected Org Level items – The user will have access to the employee’s home organization level assignment as well as the selected organization level items when overriding an employee’s organization levels. Select those organization levels in the listing box below the org levels drop-down.
In this example, we want to restrict the employee’s access to only be able to select the jobs Forklift, Project A, Project K and Project P.
With the proper Company Selected:
4. Select the Org Level Depth needed
5. Select the type of Permissions needed
6. Move the org level items to the left the allow or deny access depending on the permission type selected
7. Click to apply the restrictions.
IP Address Restrictions
IP address restrictions can be a helpful tool that will prevent employees from logging in or punching from offsite. If your organization has a concern that employees are punching in from places other than their work computers and getting paid for hours they’re not working, IP address restrictions can help alleviate that concern.
Permissions can be established to allow employees to login to the system and manage/send requests, approve time off and other Time & Attendance details while maintaining the lockout from the Web Punch Clock.
Managing IP address restrictions whitelist
As organizations expand to new locations, or improve their IT infrastructure, IP addresses may change during the process. Therefore, to avoid employees from being locked out of the TimeStar system, it’s important to manage the IP address whitelist via the Group Security page or User Security page depending on your systems setup.
1. Select the User that requires modification via the employee drop-down:
- Verify the information in the dashboard makes sense with the user selected to avoid updating the wrong individual.
2. Locate the Restrict Access by IP Address or DNS, and click Manage Restrictions.
A warning window will appear, click OK.
3. On the pop-up window, select the Address Type to restrict
You will have the ability to set the Address Type restrictions by:
-
-
- Single IPv4 Address
- IPv4 Network
- IPv4 Range
- Single IPv6 Address
- IPv6 Network
- Local IP
-
4. Click the plus button 
under assigned IPs to add a new line
5. IP Address – Enter the IP address into the text box that will be allowed access
-
- Note: Check with your IT representative if you are unsure of your IP address. You may also search for the phrase “what is my IP address” in your favorite search engine to identify your public IP address.
6. Click Save
- Repeat steps above to add another single IP Address or Address Range.
- Close out of window when all entries have been added.
7. Apply IP Restrictions to selected user by setting the Restrict Access by IP Address or DNS to Yes
8. Click
Add, Edit, Or Remove A Mobile Profile
Adding a Mobile Profile to a User Security will determine what features the employee assigned will have access to on the Mobile App. Mobile Profiles are also where any geofenced locations would be established. For more information on Mobile Profiles, please see our Mobile Profiles support page.
A. Select the Employee to modify in the Employee Dropdown.
B. Verify the User Security data matches up with the employee selected.
B. Select the Mobile Profile to apply, or select (none). If set to (none), the system will use any mobile profile assigned to the employee’s Security Group. If the security group is also set to (none), the ability to access the Mobile App will be removed.
D. Click the 
button.
