Windows Vista Parental Controls

Most of the info on this blog has been focused on the benefits of User Account Control for the enterprise and was written for IT professionals and developers. This post highlights one of the key benefits for home computer users, and in particular, for parents.


One of the limitations to providing really complete parental controls in the past was that all users of the computers were administrators and could probably undo most of the settings the parent tried to enforce. Windows Vista helps solve that problem by enabling people to use Windows without administrator privileges and adds a robust set of Parental Controls that parents can use to ensure their children are accessing appropriate programs and Web sites, when it is appropriate for them to be doing so.


To illustrate how the Family Safety Settings work and how they are integrated with User Account Control, I will use characters in a fictitious family where Abby is the parent and Toby is the child. Abby and Toby are personas that we’ve been using for years in developing Windows Vista and you will see these names often in screenshots on and in demonstrations of Windows Vista.


Integral to the successful use of parental controls is the concept of User Account Control, and individual, non-administrator accounts for each user. Abby empowers Toby by giving him his own logon account, but with parameters that ensure she can confidently give him his independence within that account.


After creating an account for Toby, Abby enables Parental Controls on Toby’s account through the Control Panel. Abby can chose to limit what Web sites Toby can visit, what programs and games Toby can use, what time he can use the computer, and she can also access a report on all of his activities. Parental Controls in Windows Vista gives parents the option of taking a more active role in their children’s safe computer use, if they so choose, and can facilitate some healthy discussions about boundaries and how to stay safe online.

See larger screen shot.


To encourage a collaborative approach to child safe computing, limitations set through Parental Controls are not hidden in Windows Vista – if Toby tries to access a Web site that his mother did not give him permission to see, he will see the following screen in his Web browser informing him that the Web site is blocked.


See larger screen shot.

However, the screen also provides a link to “Ask an administrator for permission” to visit the site. If he clicks that link, he will be given the User Account Control over-the shoulder credentials prompt. This way if Abby feels like this is a site she wants Toby to visit, she has an easy way to grant permission.




After she provides her password, she is given one more dialog so she knows exactly what site she is giving Toby access to.



This example highlights the need to have strong passwords for all computer accounts. If Abby’s password was blank or easily guessed, Toby could easily circumvent the parental controls.


This also underscores the need for software that works well for non-administrator accounts. We anticipate that the Parental Controls will be a primary reason that many families want to get a computer with Windows Vista. However, since Parental Controls can only be enabled for non-administrator accounts, it is important that software developers create software—particularly educational tools, games, and other programs designed for children—that works well for standard users.


– Alex Heaton
  User Account Control Product Manager


Comments (35)

  1. Sidebar Geek says:

    The UAC Team has posted an indepth article on Windows Vista’s Parental Controls. The Parental Controls…

  2. Dean Harding says:

    With the "Game Ratings" stuff, how does that work? Do games report their rating when they’re installed or something?

    What about if a game doesn’t report any rating, where does it sit?

  3. Someone Special says:

    Apart from showing of, why would professionals bother with these controls, when you can use group policy etc?

    Or can these settings all be customised by group policy?

    Why don’t you call it: "Administrator Safety Settings" in the Business and Enterprise, and maybe Ultimate Versions.

    You can Keep the current name in the Home versions.

    Surely, this makes more sense!

  4. Doug says:

    Please ignore "Someone Special" and keep this in all consumer versions.

    If it helps to keep the codebase identical, then keep it in all.  It doesn’t hurt anybody.

  5. Brian Trenbeath (Program Manager) says:

    I’m the Program Manager for the Parental Controls feature in Windows Vista. I want to answer a few of the questions brought up here.

    1. How does the games rating stuff work?

    A. The rating information is included in a file called the GDF (game definition file) that is part of the game.  However, just because a game supports our GDF format, it doesn’t mean it has been rated by the different ratings boards through out the world.  This is up to the publisher / developer to do and include in the GDF.  It is a very common scenario for a game to be rated by the ESRB (US rating system) but not some of the others.  This means the game will show up as unrated if such a rating system is selected.

    For games that don’t include a GDF (anything done before now) there are 2 possibilities – 1) We have a list of over 2000 tier 1 games that Windows Vista recognizes and pulls down the data much like Media Player grabs artist and album information, or 2) The game shows as unrated.  Parental Controls allows you to bulk block games that are unrated as well as selectively allow those you are comfortable with on a per-game basis.

    2. What SKU’s will parental controls be in?

    A. Parental Controls will be available in all consumer SKU’s, including Starter Edition and Ultimate. It will NOT be in any of the business SKU’s nor server SKU’s. While we recognize that some of the Parental Controls functionality could be desirable in a business environment, they have not been architected to work optimally in those environments. Parental Controls in Windows Vista is tailored to family usage in homes.

    -Brian Trenbeath

    Program Manager

    Windows Vista Parental Controls


  6. Arnold Sia says:


  7. This looks really nice, however I am missing one (I think important) thing – could there be support for delayed approval? I mean like Tobby is at home, he is surfing the web and found a page he cannot enter and he would like to. When he click on Ask an administrator for permission, he could select

    a.) if administrator is around (over-shoulder box)

    b.) if administrator is away (Abby at work).

    When Abby returns home, she will logon and she will see second dialog (Will you allow Tobby to view these websites?)…

  8. mIKW says:

    Smart children will go download a copy of Firefox instead. 🙂

  9. Sony just announced new Vaio PC models ([1], [2]) complete with “Vista capable” stickers. There will shortly be many more from all the OEMs.
    Mary Jo Foley speculates on what the Vista delay will mean for the nominally biennial follow-ons

  10. Joe says:

    Two suggestions…

    1) In the "Will you allow Toby to access this website?" dialog, it would be nice if there was a 3rd button saying to "Preview" the website or "Allow One Time" so a website can be seen once by the parent before really committing to always allowing it. Usually the web address is not enough to make a decision. I think MSN parental controls has this already.

    2) It would be nice if the Time Limits could work such that time limits could be placed on individual programs, or at least on web access. Probably better (more robust) if it could be for particular programs. For instance, I might want to let my child use Word, Excel, etc. as much as they want so they can do homework, but time limit how much they can use MSN Messenger, IE, or AIM or games.

  11. Dean Harding says:

    > Smart children will go download a copy of Firefox instead.

    No they won’t, Parental Controls only work when the child is not an administrator. Even if you /could/ install Firefox as a non-admin, a parent would just block them from installing it or running it.

    It would be a bit pointless if you could do otherwise.

  12. Alex Heaton (MS) says:

    Even if the person is using a browser other than Internet Explorer the Parental Controls will block non-approved URLs.

  13. - says:

    You CAN install FF in a restricted account if you point the installer to a folder you can write to (the desktop, for example). You can even download the binaries without installer and that’ll work too.

    To workaround this "protection", you can use a extension that bypasses the OS-provided DNS resolver (wich I guess is where the protection will be), doing HTTP requests to a certain IP to resolve names.

    I’ve yet to see a filter that I can’t defeat in less that 5 minutes.

  14. Dean Harding says:

    I’d say the filter is probably built into the Windows firewall, which you CAN’T bypass, and you certainly won’t be able to stop the firewall without being an administrator.

  15. - says:

    Dean: Yes, I can bypass that, with the help of an external computer. And I don’t have to set it up, in fact there are already several "anonymous browsing" pages available that let you proxy through them. The only way to avoid this is to use whitelisting and only allow certain sites, which is brutally restrictive.

    If the protection only checks DNS requests, you can also use certain pages (accessing them by IP) to resolve addresses for you. To avoid this, it’d have to do reverse DNS lookups for every unknown IP you try to connect to…

    That said, I agree that firewall blocking is more than enough in the general case.

  16. EBH says:

    I welcome the inclusion of parental controls in Vista. This is something I have wanted to start using for my kids, but I haven’t found a suitabel application out there yet. So I will be upgrading our PCs as soon as I can.

    I notice that using the parental controls I can set the times of day that each child can use the PC. Is it also possible to limit the total number of hours used per day or per week rather than restricting to certain times of day?

  17. Supansa McLean says:

    If you have children, these are just a few of the many benefits that can be achieved by installing parental control software in you home’s computer. A vital weapon in the battle to keep your child’s computer use safe and educational, parental control software can be considered as a bady-sitter for your kids when you are not available to oversee their computer and Internet activity.

  18. Supansa McLean says:

    If you have children, these are just a few of the many benefits that can be achieved by installing parental control software in you home’s computer. A vital weapon in the battle to keep your child’s computer use safe and educational, parental control software can be considered as a bady-sitter for your kids when you are not available to oversee their computer and Internet activity.

  19. Peter says:

    Just in case developers actually try to use Parental controls — be prepared for one of the most awful experiences of your professional life.  The documentation hardly exists; when it does exist, it is both thin and generally wrong.  The APIs, in turn, tend to fail at the drop of a hat for no obvious reasons.  As icing on the cake, the sometimes-on and sometimes-off nature mean that testing Parental Control code will take up an inordinate amount of your QA cycles (do you have a QA lab?  It’s probably on a domain — which means that Parental controls are OFF.  Or if you use a ‘business’ edition.  Except for some).

    The Microsoft programmers and developers would have done this entire country a service by skipping their work entirely and taking up a good hobby.

  20. james says:

    I don’t see what use the Time Limits are, since my daughter just changes them, even though she is just a standard user.

    What’s the point of me setting them for her if she can just go in and change them?


  21. jordi says:

    I dont have installed parental control. How do I do?

  22. Brady says:

    I browsed through the help files on this and found something like…"On the start screen, scroll to Tasks, click settings, click General, and then click Parental Controls."

    Start screen? I didn’t understand that because when I start Parental Controls(PC) in Vista the tasks are already listed in the left pane and don’t even include "Settings".

    The help file continues to talk about being able to change an access code. Where is that??? It seems that Vista has erroneous help files and has tied everything to the user/admin accounts and their passwords.

    In my case, I need 2 admins. 1 that has access to everything and sets the password to PC. And 1 that can do everything EXCEPT change the PC settings or passwords.

  23. Eddy F says:

    Enforcing Parental Controls, with Off everywhere prevents web connect to one of Toby’s applications.  Removing controls restores it.  Why, please?