Lock Down Vista with Parental Controls

Won't someone think of the children?

Microsoft did. Windows Vista comes with powerful and easy-to-use features that anyone can wield to prevent kids and other unauthorized users from accessing all kinds of things. Anybody with an administrator account can prevent users with standard accounts from downloading files, accessing certain games and applications, using the computer at certain times of day, and so on.

Of course, we're talking about a new operating system and thousands of old programs, so there are bound to be loopholes. Your kid doesn't have to be a ninja hacker to discover items you've overlooked through no fault of your own. For example, sometimes Vista doesn't recognize a game as being a game, and you have to block it as an application. Further, Vista's Parental Controls rely upon User Account Control, and it's only as strong as an administrator's password.

To use Parental Controls, you'll need a PC with Windows Vista, plus at least one administrator account and at least one standard account. It's easy for an admin to create accounts; just hit Control Panel, click User Accounts and Family Safety, and click User Accounts. From there you can set up and delete user accounts on your PC.

You can set up Parental Controls for any standard account. Because Parental Controls are largely enforced via User Account Control (UAC), they won't allow you to administer an administrator account—UAC in administrator accounts is interruptive, sometimes, but only requires a click to proceed with what you're doing. In a standard account, a UAC interruption requires an admin password to proceed.

Thus, the first thing that Parental Controls blocks is the ability to do virtually anything normally blocked by UAC. That includes account administration, altering the firewall, allowing remote access to the system, altering the system in any low-level way, installing software, and so on. UAC will interrupt if you partake in any activity in Vista where you see a little shield festooned with the Windows colors.

When you actually open Parental Controls, you see a list of what they will allow you do allow. Parental Controls include:

• A Web filter, which lets you block certain Web content. You can force it to use blacklists and whitelists (lists of blocked and allowed sites, the most hands-on method) or choose various objectionable materials such as porn, bomb making, drugs, gambling, and so on. You can elect to block or allow sites that aren't rated or recognized by the filter.
• Time limits, which let you dictate what time of day a standard account, may be accessed.
• Games controls, which let you block or allow access to games based on ratings or your own personal whims.
• Specific program access controls, which let you allow or block access to any given program.

For example, with Parental Controls you can block access to any application you wish, so if you don't want your kids chatting with strangers through an instant messenger or an IRC client, you can block them. You can turn off access to any game you please, so even if a game is rated Everyone by the ESRB, you can still block it while allowing other Everyone-rated games through. You can prevent users from using the computer at any hour of the day you wish. You can create lists of blocked and allowed Web sites or filter the Web for specific content.

What Parental Controls Do and Don't Do

The Web filter works hand-in-hand with Internet Explorer 7.0+, Vista's version of Microsoft's latest Internet browser. In other words, it won't work with browsers like Firefox or Opera. You can, of course, block access to such browsers if they're installed on your system.

With time limits, you can fill in a grid to block use of the computer for standard accounts hour-by-hour. The grid represents an entire week, so you can, say, mandate stronger controls for weeknights than for weekends. It's not powerful enough, however, to offer blockage of specific days of the year or any other exception to the week-by-week, hour-by-hour administration.

The game controls are the weakest link. You can conveniently launch Parental Controls from the Games window, and you can mandate which games can and cannot be played by the various standard accounts on the computer—either by rating or specifically. Be wary, though; while Vista contains a catalog of thousands of games along with their ratings, games that it doesn't recognize aren't affected by Parental Controls.

For example, in my testing, I installed Battlefield 2142, which Vista didn't see as a game. Even though I blocked all games rated above Everyone 10+ by the ESRB, I could still launch Battlefield 2142 through my standard account. To block it, I actually had to treat it as a generic application and block it from the program access controls.

Parental Control's Weaknesses

Parental Controls are there so you don't have to stand over your child's shoulder 24 hours a day. They can also help you prevent any user from goofing around with programs that you'd really rather preserve for administrators.

They work well, but they're not flawless.

The most pressing advice for a parent or administrator is to check your work. If I hadn't tried to fire up Battlefield 2142 through a standard account, I'd have thought it would have been blocked.

After you administer via the Parental Controls feature, jump into the affected account and try to access stuff you'd prefer the user couldn't. Try to start programs you don't want the user to be able to launch, such as IM clients, system utilities, and so on. Try to access Web pages you'd prefer were blocked.

Make a list of anything you'd prefer your standard accounts not have access to that's not blocked, and then head back into the admin account and tweak the settings. It might take a while, but you can eventually tailor Parental Controls to your whims.

The biggest weakness in the chain of command is the admin password. All it would take to bypass any blocked content, game, program, or activity would be an admin password, and if your standard account users can guess it, all your work will have been for naught. Not only can a user get through UAC with the right password, he or she can also access your account and do things like turn off Parental Controls and even turn off UAC. Believe it or not, even the latter can be a bad thing.

What's more, while I couldn't find a crack floating around, it's unlikely that Parental Controls won't be cracked. It'll be a difficult task to crack it; a UAC interruption halts any access to the system other than the ability to punch in a password or click on the UAC dialog, so a brute force application might not work. That said, virtually anything can be cracked and you can bet that hackers are working on it right now.

That brings me to two more pieces of advice: Make your password secure, and keep Windows Vista up to date.

A secure password isn't the name of your dog or your birth date. It's a series of unrelated, capital and lowercase letters, plus numbers and any symbols allowed. "123456" and "Rover" are not strong passwords; "tJ7-Pl86bZh" is a strong password. Of course, the most secure passwords aren't easy to remember, but if you write them down and keep them near the computer, your standard account users won't have to look far to "crack" them.

Hopefully, as parts of Vista are cracked, Microsoft will provide updates to patch them or, at the very least, to give the hackers more work to do before they're cracked again. Turn on Automatic Updates and be sure that Windows Vista is always up to date.

Use with Care

I remember once when I was looking for Dick's Sporting Goods' Web site and I typed in the obvious URL. Boy, was I surprised. Had my son or daughter done that, I would have been rather upset, and also subject to giving an impromptu anatomy lesson that I wasn't prepared to give.

That was Windows XP, and its Web content filter was pathetic. I scrambled to download and register Net Nanny and Cyber Patrol and other applications, none of which really worked as well as I'd wanted them to. What I wanted was easy-to-use, operating system—level controls that let me decide virtually anything and everything that any other user could do, and I got them—somewhat—with Windows Vista.