Windows Forum

Ask something
Question Locked

Win7 Parental Controls

0 helpful
25 replies

by acgphx 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I guess it happens to everyone in IT at one time or another. I was asked to lockdown a single user profile on a stand aline WIN7 Home Premium box for a friend to prevent her 15 year old son from using IM to sex chat with people.

I enabled Win7 Parental controls.

Removed access to MSN Messenger and yahoo Messenger.

I setup time restrictions which would prevent him from getting up after she went to bed and playing online.

I removed the teens password.

I ensured that my friends account was password protected and that she was the only administrative account on that box.

Two days went by before I checked in on the system. Somehow this kid managed to disable parental controls and regained access to everthing I restricted. Without administrative access I'm not sure how he managed to pull this off.

Are MS Prental Controls that weak that the user its supposed to be limiting is able to un-do it? Could this kid have guessed his mom's password or maybe his sisters passward (standard user) and shut off the restrictions? Could he somehow have restored the system to undo the parental controls?

This is really ticking me off...I can't believe that MS would promote these tools if they were so easy to get around. Any insights, and advice, would be appreciated.

25 replies

by santeewelding

Despite you, mom, or Microsoft, I'm betting that fifteen and hormones will overcome you all, every time.

by acgphx

While I appreciate your response and even agree with it to some degree, I don't believe it helps work toward an answer.

by robo_dev

Seriously, I've seen seven-year old kids figure out how to bypass security controls in literally minutes.

You must NEVER write down your passwords, NEVER use the same password for multiple devices, and change your admin passwords often.

And watch out for 'shoulder surfing', as some of these miscreants have excellent vision and memory...two things us old fogeys lost long ago.

by robo_dev

Client Software:
1) There is a free app called K9 from BlueCoat. Very powerful app that so far has not been hacked by the end user an installation I have done of the app.
http://www1.k9webprotection.com/

Proxy Server:
A more sophisticated approach is to deploy a proxy server and/or segment the LAN into grown-up and kids network.

I use a proxy called AllegroSurf from RhinoSoft. This allows complete control, either blacklists/whitelists of web content, as well as automatic category filtering. It also allows granular control of individual ports/services (e.g. IM, MS-Messenger, etc.). AllegroSurf costs around $40/user, and you need an extra PC to run it.
http://www.allegrosurf.com/

I run this on a separate network segment, so there is no way around the proxy, period. The proxy is the gateway to the Internet. I also have a firewall between the kids and adults network as some Nintendo devices do not play well with proxy servers.

An alternate proxy is Untangle. This is an open-source app that's free. I have not used it, but it looks very powerful.
http://www.untangle.com/

by acgphx

In your experience id MS parental controls just that weak? How, without the admin password or administrative authority, did he manage to get around parental controls?

by robo_dev

Let's just say that there are lots of "local privilege escalation exploits" that kids all seem to know about.

For starters, many people install a new Windows PC and leave the admin password blank. I will also hint that the Windows task scheduler runs with system-level access for many versions of Windows, and that I've never seen a group policy that a good VBScript could not bypass.

Even if components of the OS are removed, a clever youth can re-download those from the Internet. And I won't even mention what can be done with a bootable CD or jump drive running an alternate OS...the word 'owned' comes to mind. :)

A fatal security flaw is to use the same password for many different things, and if the child knows that, it makes it much easier to guess or discover the admin password.

by tobif

I think he has known her password all the time. And then it's just a quick session to do the settings.
Or he could have changed while she went to cook some tea.

by acgphx

I'm going to recommend that she and her daughter change their passwords just to be on the safe side. I know 15 is a torrent of hormones but I also understand her concern finding her boy chatting sex online IN THE LIVING ROOM. Bah...kids.

by robo_dev

In the US, since he is a minor, any adults who were chatting with him were committing a felony.

If the boy were chatting with a minor girl online, he could be technically be charged with a felony as well, although many prosecutors would drop that type of case.

Even worse would be the scenario that the girl he's chatting with is actually a police officer posing as an underage girl, while collecting IP information in support of a search warrant.

by tobif

Unless your friend needs to be logged in as admin, why not make her usual account less elevated. Then show her how to temporarily gain power when needed.

That way, trojans and kids will have a bit harder time to change things deep inside the system, even if they should get to the PC when she is logged in.

by acgphx

Weird, I never had to lock down a stand alone system. I'm amazed MS can pitch this parental control to parents then have it so easily infultrated.

Appreciated.

by acgphx

I'm not here for moral advice, simple recommendation based on professional experience. Stating the obvious (where there's a will....) isn't constructive and didn't advance the information request.

Regardless, she asked for help I responded. How she wants her "laces" is entirely her business. As a friend all I could do is help. I was simply wondering just how inept MS parental controls actually are AND thought to seek an answer in this diverse community of IT pro's.

by acgphx

I was told its a GF he hid from his mother that he met at school who moved back east. Not sure if thats true or not but thats what he told her and she me. I hope thats what is actually happening...any scenario you pointed out could get pretty ugly pretty fast.

by robo_dev

Not to be all doom and gloom, but in today's environment you need to be sooo careful.

For example, if a child has viewed porn online and they were to tell a school counselor or family therapist about it, the counselor is required by law to report it to the child protective services authority in their state.

For parents who did nothing wrong, this simple thing could result in a terrifying visit from law enforcement and child protective services, depending on the circumstances and the age of the child.

Note that there are several email services especially for kids. There is one called KidSafeMail that allows parents to define email whitelists/blacklists and BCCs all emails to the parent. It even has a profanity filter that puts the word BEEP in place of bad words in an email.

by tobif

If you're determined, you could browse through login events etc in the system log and compare that to her memory on when she used the computer herself...

by acgphx

I was thinking the same thing. I intend to try that when I see them again provided she really wants to know.

by Wizard57M-TR

There could still be an "administrator account" on your friends computer that does not have a password. May not be able to gain access to this account without booting into "Safe Mode"...try that, and if it is listed, choose it and add a password that only your friend knows, or give them the password afterwards if they trust you with it. Then using this account, verify Parental Controls for all the other accounts.

by acgphx

I thought of that but didn't see one in safe mode or otherwise. Just to be safe I had them both change their passwords leaving the boys account without one and restricted. I've re-locked it down, we'll see if he gets by it again.

by Wizard57M-TR

I mean, if the 15 yr old is as tenacious as, well, I was when I was 15 (don't ask, hehe) then he may have a bootable USB stick or CD with loads of utilities. FTR---PCs did not exist when I was 15...but turntables were always fun to take apart and reverse the belts on, hehe!
Anyhow, temporarily disable booting from external drives/devices, password protect the BIOS, and see how that goes.

by acgphx

I didn't give him credit for that. I know the kid and he doesn't seem like the type...then again who is these days.

by Wizard57M-TR

Ahh, yes, that old problem of identifying the "type"! Basically, they can be anyone, and I do mean anyone. My step-daughter has this handy-dandy keychain USB fob...I haven't shown her all the tricks she could do with it, she uses it to transfer pictures and such from one computer to another. But the casual glance at her keychain doesn't reveal anything special, just another little doo-dad amongst the keys, braids and trinkets. Remove the cap and voila...instant bootable device, many of which contain full operating systems!

by Wizard57M-TR

If it is enabled, check the security settings of what computers are allowed to connect and control your friends desktop.
This includes stuff like pcAnywhere, LogMeIn, etc.
While you're at it, check for keyloggers, extra "dongles", as well as malware (MalwareBytes comes in handy).

This discussion is closed to new replies.