3.3.5.2.5 MS-Quarantine-Grace-Time
When a NAS receives this attribute in an Access-Accept message, it applies a time-out to the endpoint requesting network access set to expire at the time given by the attribute's value.
The NAS gives full access to the endpoint as long as the time-out has not expired.
After the time-out expires, the NAS moves the client to a restricted quarantine connection.
If the NAS later gets another Access-Accept for this endpoint, the previous grace time-out is dropped. Either the endpoint will get unrestricted access or a new grace time-out will be applied if this attribute is set again.
For more details about this attribute, see section 2.2.1.10.