locked
Parental Control and UAC RRS feed

  • General discussion

  • RFC Document

     

    Parental Control and UAC

     

     

    Date : 1st August, 2009

     

    Authored by : K. Sampath Kumar,

    Technical Consultant,

    Madurai, TN, India.

     

     

     

     

     

    Introduction

     

    User accounts are required when you wish to share your computer with several people at home, but, still you wish to have your own files and settings. We can say that a user account is a collection of information that tells Windows what files and folders a user can access, make changes and manage the personal preferences of an user in Windows.

    Each user can access their user account with a user name and password. There are three different type of accounts namely, Standard User, Administrator and Guest. User Accounts are created by the Administrator and most common type allocated for a person is Standard User.

    This document is prepared in earnest to shed some light on home computing environment and requirements for setting up and using Parental Controls when sharing computing resources at home.

     

    1. User Account Control (UAC)

     

    User Account Control is a new feature in Windows Operating System that can help prevent unauthorized changes to your computer. UAC does this by asking you for your permission or an administrator password before performing actions that could potentially affect your computer's operation or that will change settings that will affect other users.

     

    UAC will be displaying an alert message requesting confirmation to ensure the action or program that's about to start is one that you intended to start. UAC does this primarily to prevent malicious software and spy ware from being installed and making changes to your computer without permission. You can also change the behavior of the User Account Control message.

     

    As recommended and to protect your computer, you create standard user accounts for all the users who share the computer. If a user has a standard account tries to install software, Windows will ask for an administrator account's password so that software can't be installed without your knowledge and permission.

     

    Standard Account user can surf the Internet, send e-mail, and use a word processor. However, if you want to perform an administrative task, such as installing a new program or changing a setting that will affect other users, you need not switch to an administrator account. Windows will prompt you for permission or an administrator password before performing the task.

     

    2. Standard Account User with Parental Controls

     

    Parental Controls is a classification of user account assigned to a standard account user. It cannot be assigned to an Administrator. This classification is necessary because it is normally assigned to identify users who require some control or guidance when using computer. This feature has to be turned ’On’ by the administrator. Parental Controls will help you to manage how your children shall use the computer, by setting limits on your children's access to the web, the hours they can log on to the computer, and restricting which games they can play and programs they can run.

     

    When Parental Controls blocks access to a webpage or game, a notification is displayed that the webpage or program has been blocked. Your child can click a link in the notification to request permission for access to that webpage or program. You can allow access by entering your Administrator account information.

     

    3. Parental Control in Windows Implementation 

    The above paragraphs would have given a brief understanding on UAC and Parental Control features available in Windows. Here let us see in more detail about where and how the Parental Control feature is available in Windows and some problems faced in implementing the Parental Control feature.

     

    For a parental control to be set up you first have to create a Standard User and then for the created standard user account you have to set the individual Parental Controls by Clicking the Parental Controls: 'On'. If, Activity Reporting is required you can Click it ‘On‘. Activity reporting will collect information about the computer usage and the report will be reminded at the frequency we set, for example : Weekly or daily.

     

    After which, options for Windows Settings are required to be set up. Let us see these options and how they are required to be set up.

     1. Windows Vista Web Filter

     

    The web filter works by rating the content of websites and blocking some websites based the content categories I decide as objectionable. By turning this 'On' the filter may reduce the number of objectionable websites viewable but, it cannot be absolute protection. The reason being the objectionable content are subjective and universally well known.

     

    In this option we(as Parents) are required to control allowed websites, downloads, and other use. We have to opt to specify, “Which parts of Internet can the USER visit?” .

    . Block some websites or content (or)

    . Allow all websites and content

     

    If we select first option above then we have the option to specify the list to

    Allow and block specific Websites. In this we can Edit the Allow and block list and then we can opt to allow only the websites which are on the allow list.

     

    We can also Choose the restriction level to Block web content automatically. The restriction level are categorized as .High .Medium .None .Custom . In custom level we need to choose content categories to block specific content.

     

    An option to Block File downloads can also be clicked in order to disallow downloads.

     

     2. Time Limits

     

    In this option we can Control when and at what Time our children will be using the computer.

     

     3. Games

     

    In this option we can control games by rating, content, or title by specifying whether the USER can be allowed to play games. If 'Yes' then we need to allow or block the games by rating and content types. This has to be done by Setting Game Ratings. Different type of ratings are available and the access to these Games will be allowed or blocked based on the Okayed Game Ratings which we require to set up. By default the ratings available in my Computer was supported by ESRB. Once this is set we can also Block (or Allow) any game on your computer by name.

     

     4. Allow and block specific programs

     

    In this we can specify the programs which can be used by the USER. When we specify these options we can Allow (or) block any programs on your computer. The available options are

    . USER can use all programs

    . USER can only use the programs I allow

     

    By default the first option is selected, but, if you require to specify and control only the programs which you allow, you need to select the second option. When the second option is selected a list of program will be shown from which you can select and Check the programs that can be used.

     

    After all the above options are set, Click ‘OK’ for the user and the Parental Control will be activated when the USER log on the computer.

     

     

    3. Problems faced with Parental Control in Windows 

    It would be more appropriate if I could explain what are the problems faced when trying to implement the Parental Controls and in enforcing it in the Home.

     Scenario for Typical Home

     

    I am a home user and recently purchased a Home PC with loads of OEM software and goodies and the OS was Windows Vista Home Premium. We both are working parents and have two children. Eldest son is High School Grader and youngest daughter is First Grader. We decide to share the Home PC and as recommended we started by creating individual User Account for everyone at home. This would mean default 1 (One) Administrator User Account and 4 (Four) Standard User Account with 2 (Two) to be set with Parental Controls. The default Administrator User Account would be assigned the first time when you start operating the computer.

     

    Logged in as Administrator I created, initially 2 (Two) Standard user account meant for us, the parents. Then, I started creating 2 (Two) Standard User Accounts with Parental Controls to be Clicked ’On’.

     

    Then for each user account I started Setting the individual Parental Controls respectively. I clicked the Parental Controls: 'On'.

     

    For Activity Reporting, I clicked ’On’ and frequency I selected for Activity Viewing initially was every day.

     

    Problem !! 

    As recommended, we created a Standard User Account for us Parents. We as User will be accessing the computer using our individual login id. The Administrator User will not be frequently used for log in and will be used mostly when installing application programs and when performing other set ups.

     

    We could not understand this .

    i) How and who will be assigned to view Activity reporting ?

    ii) How and why should an Administrator be assigned as a parent, to view Activity reporting of our Children?

    iii) Any other standard user also cannot be considered as a parent !!

    iv) Why as a parent using our individual User Account we are not able to view our Childs Activity Reporting and why we should use an Administrator Account?

     

     

    Finally, we decided to click ’Off’ for Activity Reporting, as we thought it may not be needed at this stage.

     

    Continuing further, we proceeded with setting the options for Windows Settings. The options chosen by us and problems faced are given category wise.

     

     1. Windows Vista Web Filter

     

    For setting this we entered our option, by turning this Filter ‘On’ by clicking ‘Block some websites or content’. We did not enter any specific websites as we were not sure which site contains what content. We decided to use the ‘Block Web Content Automatically’ and the default set rate as Medium. Downloads were not checked for blocking.

     

    Problem !! 

    1. We felt that we would be facing issues when downloading huge content using Web. We also will not be able to control on, which content is being downloaded, from where and whether it contains malware etc. But, instead of totally blocking all downloads we decided to leave this issue open.

     

    2. What will happen to the downloaded contents by Standard User which is available in the Public area and Disk space. ?

     

    3. For searching contents in Web and in controlling the Web search there had already been known issues. How can we control the objectionable content from being returned by the Web search engine ?

     

    4. How to stop irrelevant Advertisement content and Shopping sites not suited for my children ?

     

    5. Now, the big question is., how will the Web Site or content manager be able to decide to age of my children ? Search engines like Bing, Yahoo, Google obviously will not be able to check the age group.

     

    6. Why, as a Parent, I am not being notified for download requests?

     

    7. Why am I (Parent) not being allowed to decide what is the content of the downloads immediately after a download is completed?

     

    Finally we decided to leave everything to default.

     

     2. Time Limits

     

    This option seems to be Okay and we decided to leave it for now and did not set any Time Limits for accessing the computer.

     

     3. Games (or) Entertainment content  

    Here, we had to specify which types of Games the USER (the user with Parental Controls) can play and this can be controlled by rating, content or title. Our chosen options was 'Yes', USER can play games. After which we have the option of choosing which type of games USER can play and choose whether we have to Allow (or) Block games by rating and content types. For this we have to Set the game ratings.

     

    First we have to choose whether USER can play games if the game does not have a rating. We clicked to . Allow games with no rating

     

    Then we have to specify which ratings are ‘Ok’ for USER to play. By default the rating is always positioned at 18+ or ADULTS ONLY rating. Then we have to choose which games has to be blocked based on the content it contains. We chose to retain the default values.

     

    Now, we have the option to 'Block or Allow specific games' . When we clicked this option we were shown the Games which came pre-installed by the Microsoft Games. Other games provided by the OEM did not show up in the list.

     

    Problem !! 

    1. Here also, the age of my children is not taken into consideration as it is not requested to be filled in by the parent.

     

    2. When games developed and rated by external agencies it is not available in the list of ‘Block or Allow specific games’.

     

    3. There is no way to identify that the software or application being installed belongs to the entertainment category or Games category.

     

    4. The UAC already defines that Administrator permission is required to install a new software. But, the activity reporting does not show the new application or games installed as the distinction between administrator and parent is not available.

     

    5. Why when installing a new software of unrated content the parent or administrator is not notified to identify the content and rate it accordingly ?

     

    6. Why am I (Parent) not being allowed to decide and rate the contents of entertainment or video content when no ratings are available ?

      

    4. Allow and block specific programs 

    In this we had to select the options whether to Allow or Block specific programs. We initially chose to Block some programs and allow the USER to run only the programs we allow. Okay, the computer took some time in displaying all the programs installed. We then had to click which programs are to be used by the User.

     

    Problem !! 

    1. The list of programs displayed were not in program groups as is normally shown in the Start Menu.

     

    2. The list included some programs which should not be present there at all. For example

     

    a) lot of files named setup.exe from locations including Install Shield

    b) shutdown.exe

    c) My Antivirus software (Norton) and all its executables

    d) On verifying with my Laptop I found that Touch Pad and its executables also

    showed up in the list.

     

    3. Application executable files from common shared locations were included in the list to be allowed to be blocked.

     

    4. Why am I not asked when I install a new application what type of application is it?

     

    Finally, we decided to select the default , .USER can use all programs

     

     

     

    Is any solution available to make the Parental Controls more parent friendly?

     

     

    2. Solution 

    If only we could make the Parental Control better addressing some of the problems.!

     

    1. We should understand that Administrator is and cannot be always take the role of a parent. When a parental control is being set for a standard account an exclusive link between Parent user account and Child user account is also required. When a parent user account is assigned to a child user account (with parental controls) then the parent should be able to view the activity reporting.

     

     

    2. When assigning Parental Controls to a Standard User Account the age group of the child for whom the control is being set up is required to be updated or filled in by the Administrator.

     

     

    3. When age group of the child is available more control on the search results can be made by blocking objectionable contents and blocking of irrelevant advertising content and shopping sites can be done. Only relevant web sites suited for the age can be visited by the user.

     

     

    4. Presently there are only two options to control downloads. Either to allow or block downloads. Instead of completely blocking so as to control the downloads from the web, a notification to download can be sent to the assigned parent. Then the parent can either allow or block the download, and meanwhile the child user (with parental controls) who started the download can be alerted that the download is in progress with priority.

     

     

    5. As a parent, whenever a download is completed the content rating has to be decided by me (Parent) and I should be allowed to update the same.

     

     

    6. Most importantly, access to the /User/Public space is decided by UAC and is depending on 'Authorized User Account'. I agree with this, but, what if the child user account is able to modify or delete the files already being shared by other users. This should not happen and requires guidance before the child user account can venture into /user/public space.

     

     

    7. In setting the Games rating, the default games ratings has to be selected based on the Age Group of the child user account, which the parent is supposed to enter when the parental controls are set 'On'.

     

     

    8. Any application or software before being installed has to classified as whether it is a Game, Entertainment or Software by the administrator (or) parent. This would always ensure that more control can be made available for games.

     

    9. When for an entertainment software, games or video no ratings for the content is available the parent (or) administrator should be allowed to decide and rate the contents.

     

    10. The Windows Media Center program can direct access to Servers(for TV/Video/Media) which has only content suited for the specified Age. This would be more appropriate and helpful instead of blocking the program itself. As a parent I will not object to a Cartoon movie, Superman movie or Spiderman movie from being watched if it does not require subscription.

     

    11. When Blocking or Allowing specific programs, the programs being listed should be displayed under Program Groups like the way it is appearing in start menu. This would make it more easy to identify the program. System(0) programs should not be shown.

     

    12. If the user is a Standard User with parental controls, the user Desktop should be void of programs which requires registration, warranty etc. This can be avoided by allowing the administrator to select the program icons to be displayed in the Desktop when creating a user account.

     

     

     

    The above solutions are only indicative of possible ways or means for problems referred to given in this document.

     

     

     

     

    • Changed type KannanSampathKumar Monday, August 3, 2009 10:27 AM Discussion seems more appropriate
    Monday, August 3, 2009 10:16 AM

All replies

  • RFC Document

     

    Parental Control and UAC

     

     

    Date : 1st August, 2009

     

    Authored by : K. Sampath Kumar,

    Technical Consultant,

    Madurai, TN, India.

     

     

     

     

     

    Introduction

     

    User accounts are required when you wish to share your computer with several people at home, but, still you wish to have your own files and settings. We can say that a user account is a collection of information that tells Windows what files and folders a user can access, make changes and manage the personal preferences of an user in Windows.

    Each user can access their user account with a user name and password. There are three different type of accounts namely, Standard User, Administrator and Guest. User Accounts are created by the Administrator and most common type allocated for a person is Standard User.

    This document is prepared in earnest to shed some light on home computing environment and requirements for setting up and using Parental Controls when sharing computing resources at home.

     

    1. User Account Control (UAC)

     

    User Account Control is a new feature in Windows Operating System that can help prevent unauthorized changes to your computer. UAC does this by asking you for your permission or an administrator password before performing actions that could potentially affect your computer's operation or that will change settings that will affect other users.

     

    UAC will be displaying an alert message requesting confirmation to ensure the action or program that's about to start is one that you intended to start. UAC does this primarily to prevent malicious software and spy ware from being installed and making changes to your computer without permission. You can also change the behavior of the User Account Control message.

     

    As recommended and to protect your computer, you create standard user accounts for all the users who share the computer. If a user has a standard account tries to install software, Windows will ask for an administrator account's password so that software can't be installed without your knowledge and permission.

     

    Standard Account user can surf the Internet, send e-mail, and use a word processor. However, if you want to perform an administrative task, such as installing a new program or changing a setting that will affect other users, you need not switch to an administrator account. Windows will prompt you for permission or an administrator password before performing the task.

     

    2. Standard Account User with Parental Controls

     

    Parental Controls is a classification of user account assigned to a standard account user. It cannot be assigned to an Administrator. This classification is necessary because it is normally assigned to identify users who require some control or guidance when using computer. This feature has to be turned ’On’ by the administrator. Parental Controls will help you to manage how your children shall use the computer, by setting limits on your children's access to the web, the hours they can log on to the computer, and restricting which games they can play and programs they can run.

     

    When Parental Controls blocks access to a webpage or game, a notification is displayed that the webpage or program has been blocked. Your child can click a link in the notification to request permission for access to that webpage or program. You can allow access by entering your Administrator account information.

     

    3. Parental Control in Windows Implementation 

    The above paragraphs would have given a brief understanding on UAC and Parental Control features available in Windows. Here let us see in more detail about where and how the Parental Control feature is available in Windows and some problems faced in implementing the Parental Control feature.

     

    For a parental control to be set up you first have to create a Standard User and then for the created standard user account you have to set the individual Parental Controls by Clicking the Parental Controls: 'On'. If, Activity Reporting is required you can Click it ‘On‘. Activity reporting will collect information about the computer usage and the report will be reminded at the frequency we set, for example : Weekly or daily.

     

    After which, options for Windows Settings are required to be set up. Let us see these options and how they are required to be set up.

     1. Windows Vista Web Filter

     

    The web filter works by rating the content of websites and blocking some websites based the content categories I decide as objectionable. By turning this 'On' the filter may reduce the number of objectionable websites viewable but, it cannot be absolute protection. The reason being the objectionable content are subjective and universally well known.

     

    In this option we(as Parents) are required to control allowed websites, downloads, and other use. We have to opt to specify, “Which parts of Internet can the USER visit?” .

    . Block some websites or content (or)

    . Allow all websites and content

     

    If we select first option above then we have the option to specify the list to

    Allow and block specific Websites. In this we can Edit the Allow and block list and then we can opt to allow only the websites which are on the allow list.

     

    We can also Choose the restriction level to Block web content automatically. The restriction level are categorized as .High .Medium .None .Custom . In custom level we need to choose content categories to block specific content.

     

    An option to Block File downloads can also be clicked in order to disallow downloads.

     

     2. Time Limits

     

    In this option we can Control when and at what Time our children will be using the computer.

     

     3. Games

     

    In this option we can control games by rating, content, or title by specifying whether the USER can be allowed to play games. If 'Yes' then we need to allow or block the games by rating and content types. This has to be done by Setting Game Ratings. Different type of ratings are available and the access to these Games will be allowed or blocked based on the Okayed Game Ratings which we require to set up. By default the ratings available in my Computer was supported by ESRB. Once this is set we can also Block (or Allow) any game on your computer by name.

     

     4. Allow and block specific programs

     

    In this we can specify the programs which can be used by the USER. When we specify these options we can Allow (or) block any programs on your computer. The available options are

    . USER can use all programs

    . USER can only use the programs I allow

     

    By default the first option is selected, but, if you require to specify and control only the programs which you allow, you need to select the second option. When the second option is selected a list of program will be shown from which you can select and Check the programs that can be used.

     

    After all the above options are set, Click ‘OK’ for the user and the Parental Control will be activated when the USER log on the computer.

     

     

    3. Problems faced with Parental Control in Windows 

    It would be more appropriate if I could explain what are the problems faced when trying to implement the Parental Controls and in enforcing it in the Home.

     Scenario for Typical Home

     

    I am a home user and recently purchased a Home PC with loads of OEM software and goodies and the OS was Windows Vista Home Premium. We both are working parents and have two children. Eldest son is High School Grader and youngest daughter is First Grader. We decide to share the Home PC and as recommended we started by creating individual User Account for everyone at home. This would mean default 1 (One) Administrator User Account and 4 (Four) Standard User Account with 2 (Two) to be set with Parental Controls. The default Administrator User Account would be assigned the first time when you start operating the computer.

     

    Logged in as Administrator I created, initially 2 (Two) Standard user account meant for us, the parents. Then, I started creating 2 (Two) Standard User Accounts with Parental Controls to be Clicked ’On’.

     

    Then for each user account I started Setting the individual Parental Controls respectively. I clicked the Parental Controls: 'On'.

     

    For Activity Reporting, I clicked ’On’ and frequency I selected for Activity Viewing initially was every day.

     

    Problem !! 

    As recommended, we created a Standard User Account for us Parents. We as User will be accessing the computer using our individual login id. The Administrator User will not be frequently used for log in and will be used mostly when installing application programs and when performing other set ups.

     

    We could not understand this .

    i) How and who will be assigned to view Activity reporting ?

    ii) How and why should an Administrator be assigned as a parent, to view Activity reporting of our Children?

    iii) Any other standard user also cannot be considered as a parent !!

    iv) Why as a parent using our individual User Account we are not able to view our Childs Activity Reporting and why we should use an Administrator Account?

     

     

    Finally, we decided to click ’Off’ for Activity Reporting, as we thought it may not be needed at this stage.

     

    Continuing further, we proceeded with setting the options for Windows Settings. The options chosen by us and problems faced are given category wise.

     

     1. Windows Vista Web Filter

     

    For setting this we entered our option, by turning this Filter ‘On’ by clicking ‘Block some websites or content’. We did not enter any specific websites as we were not sure which site contains what content. We decided to use the ‘Block Web Content Automatically’ and the default set rate as Medium. Downloads were not checked for blocking.

     

    Problem !! 

    1. We felt that we would be facing issues when downloading huge content using Web. We also will not be able to control on, which content is being downloaded, from where and whether it contains malware etc. But, instead of totally blocking all downloads we decided to leave this issue open.

     

    2. What will happen to the downloaded contents by Standard User which is available in the Public area and Disk space. ?

     

    3. For searching contents in Web and in controlling the Web search there had already been known issues. How can we control the objectionable content from being returned by the Web search engine ?

     

    4. How to stop irrelevant Advertisement content and Shopping sites not suited for my children ?

     

    5. Now, the big question is., how will the Web Site or content manager be able to decide to age of my children ? Search engines like Bing, Yahoo, Google obviously will not be able to check the age group.

     

    6. Why, as a Parent, I am not being notified for download requests?

     

    7. Why am I (Parent) not being allowed to decide what is the content of the downloads immediately after a download is completed?

     

    Finally we decided to leave everything to default.

     

     2. Time Limits

     

    This option seems to be Okay and we decided to leave it for now and did not set any Time Limits for accessing the computer.

     

     3. Games 

    Here, we had to specify which types of Games the USER (the user with Parental Controls) can play and this can be controlled by rating, content or title. Our chosen options was 'Yes', USER can play games. After which we have the option of choosing which type of games USER can play and choose whether we have to Allow (or) Block games by rating and content types. For this we have to Set the game ratings.

     

    First we have to choose whether USER can play games if the game does not have a rating. We clicked to . Allow games with no rating

     

    Then we have to specify which ratings are ‘Ok’ for USER to play. By default the rating is always positioned at 18+ or ADULTS ONLY rating. Then we have to choose which games has to be blocked based on the content it contains. We chose to retain the default values.

     

    Now, we have the option to 'Block or Allow specific games' . When we clicked this option we were shown the Games which came pre-installed by the Microsoft Games. Other games provided by the OEM did not show up in the list.

     

    Problem !! 

    1. Here also, the age of my children is not taken into consideration as it is not requested to be filled in by the parent.

     

    2. When games developed and rated by external agencies it is not available in the list of ‘Block or Allow specific games’.

     

    3. There is no way to identify that the software or application being installed belongs to the entertainment category or Games category.

     

    4. The UAC already defines that Administrator permission is required to install a new software. But, the activity reporting does not show the new application or games installed as the distinction between administrator and parent is not available.

     

    5. Why when installing a new software of unrated content the parent or administrator is not notified to identify the content and rate it accordingly ?

     

    6. Why am I (Parent) not being allowed to decide and rate the contents of entertainment or video content when no ratings are available ?

      

    4. Allow and block specific programs 

    In this we had to select the options whether to Allow or Block specific programs. We initially chose to Block some programs and allow the USER to run only the programs we allow. Okay, the computer took some time in displaying all the programs installed. We then had to click which programs are to be used by the User.

     

    Problem !! 

    1. The list of programs displayed were not in program groups as is normally shown in the Start Menu.

     

    2. The list included some programs which should not be present there at all. For example

     

    a) lot of files named setup.exe from locations including Install Shield

    b) shutdown.exe

    c) My Antivirus software (Norton) and all its executables

    d) On verifying with my Laptop I found that Touch Pad and its executables also

    showed up in the list.

     

    3. Application executable files from common shared locations were included in the list to be allowed to be blocked.

     

    4. Why am I not asked when I install a new application what type of application is it?

     

    Finally, we decided to select the default , .USER can use all programs

     

     

     

    Is any solution available to make the Parental Controls more parent friendly?

     

     

    2. Solution 

    If only we could make the Parental Control better addressing some of the problems.!

     

    1. We should understand that Administrator is and cannot be always take the role of a parent. When a parental control is being set for a standard account an exclusive link between Parent user account and Child user account is also required. When a parent user account is assigned to a child user account (with parental controls) then the parent should be able to view the activity reporting.

     

     

    2. When assigning Parental Controls to a Standard User Account the age group of the child for whom the control is being set up is required to be updated or filled in by the Administrator.

     

     

    3. When age group of the child is available more control on the search results can be made by blocking objectionable contents and blocking of irrelevant advertising content and shopping sites can be done. Only relevant web sites suited for the age can be visited by the user.

     

     

    4. Presently there are only two options to control downloads. Either to allow or block downloads. Instead of completely blocking so as to control the downloads from the web, a notification to download can be sent to the assigned parent. Then the parent can either allow or block the download, and meanwhile the child user (with parental controls) who started the download can be alerted that the download is in progress with priority.

     

     

    5. As a parent, whenever a download is completed the content rating has to be decided by me (Parent) and I should be allowed to update the same.

     

     

    6. Most importantly, access to the /User/Public space is decided by UAC and is depending on 'Authorized User Account'. I agree with this, but, what if the child user account is able to modify or delete the files already being shared by other users. This should not happen and requires guidance before the child user account can venture into /user/public space.

     

     

    7. In setting the Games rating, the default games ratings has to be selected based on the Age Group of the child user account, which the parent is supposed to enter when the parental controls are set 'On'.

     

     

    8. Any application or software before being installed has to classified as whether it is a Game, Entertainment or Software by the administrator (or) parent. This would always ensure that more control can be made available for games.

     

    9. When for an entertainment software, games or video no ratings for the content is available the parent (or) administrator should be allowed to decide and rate the contents.

     

    10. The Windows Media Center program can direct access to Servers(for TV/Video/Media) which has only content suited for the specified Age. This would be more appropriate and helpful instead of blocking the program itself. As a parent I will not object to a Cartoon movie, Superman movie or Spiderman movie from being watched if it does not require subscription.

     

    11. When Blocking or Allowing specific programs, the programs being listed should be displayed under Program Groups like the way it is appearing in start menu. This would make it more easy to identify the program. System(0) programs should not be shown.

     

    12. If the user is a Standard User with parental controls, the user Desktop should be void of programs which requires registration, warranty etc. This can be avoided by allowing the administrator to select the program icons to be displayed in the Desktop when creating a user account.

     

     

     

    The above solutions are only indicative of possible ways or means for problems referred to given in this document.

     

     

     

     

    Monday, August 3, 2009 10:11 AM
  • RFC Document

     

    Parental Control and UAC

     

     

    Date : 1st August, 2009

     

    Authored by : K. Sampath Kumar,

    Technical Consultant,

    Madurai, TN, India.

     

     

     

     

     

    Introduction

     

    User accounts are required when you wish to share your computer with several people at home, but, still you wish to have your own files and settings. We can say that a user account is a collection of information that tells Windows what files and folders a user can access, make changes and manage the personal preferences of an user in Windows.

    Each user can access their user account with a user name and password. There are three different type of accounts namely, Standard User, Administrator and Guest. User Accounts are created by the Administrator and most common type allocated for a person is Standard User.

    This document is prepared in earnest to shed some light on home computing environment and requirements for setting up and using Parental Controls when sharing computing resources at home.

     

    1. User Account Control (UAC)

     

    User Account Control is a new feature in Windows Operating System that can help prevent unauthorized changes to your computer. UAC does this by asking you for your permission or an administrator password before performing actions that could potentially affect your computer's operation or that will change settings that will affect other users.

     

    UAC will be displaying an alert message requesting confirmation to ensure the action or program that's about to start is one that you intended to start. UAC does this primarily to prevent malicious software and spy ware from being installed and making changes to your computer without permission. You can also change the behavior of the User Account Control message.

     

    As recommended and to protect your computer, you create standard user accounts for all the users who share the computer. If a user has a standard account tries to install software, Windows will ask for an administrator account's password so that software can't be installed without your knowledge and permission.

     

    Standard Account user can surf the Internet, send e-mail, and use a word processor. However, if you want to perform an administrative task, such as installing a new program or changing a setting that will affect other users, you need not switch to an administrator account. Windows will prompt you for permission or an administrator password before performing the task.

     

    2. Standard Account User with Parental Controls

     

    Parental Controls is a classification of user account assigned to a standard account user. It cannot be assigned to an Administrator. This classification is necessary because it is normally assigned to identify users who require some control or guidance when using computer. This feature has to be turned ’On’ by the administrator. Parental Controls will help you to manage how your children shall use the computer, by setting limits on your children's access to the web, the hours they can log on to the computer, and restricting which games they can play and programs they can run.

     

    When Parental Controls blocks access to a webpage or game, a notification is displayed that the webpage or program has been blocked. Your child can click a link in the notification to request permission for access to that webpage or program. You can allow access by entering your Administrator account information.

     

    3. Parental Control in Windows Implementation 

    The above paragraphs would have given a brief understanding on UAC and Parental Control features available in Windows. Here let us see in more detail about where and how the Parental Control feature is available in Windows and some problems faced in implementing the Parental Control feature.

     

    For a parental control to be set up you first have to create a Standard User and then for the created standard user account you have to set the individual Parental Controls by Clicking the Parental Controls: 'On'. If, Activity Reporting is required you can Click it ‘On‘. Activity reporting will collect information about the computer usage and the report will be reminded at the frequency we set, for example : Weekly or daily.

     

    After which, options for Windows Settings are required to be set up. Let us see these options and how they are required to be set up.

     1. Windows Vista Web Filter

     

    The web filter works by rating the content of websites and blocking some websites based the content categories I decide as objectionable. By turning this 'On' the filter may reduce the number of objectionable websites viewable but, it cannot be absolute protection. The reason being the objectionable content are subjective and universally well known.

     

    In this option we(as Parents) are required to control allowed websites, downloads, and other use. We have to opt to specify, “Which parts of Internet can the USER visit?” .

    . Block some websites or content (or)

    . Allow all websites and content

     

    If we select first option above then we have the option to specify the list to

    Allow and block specific Websites. In this we can Edit the Allow and block list and then we can opt to allow only the websites which are on the allow list.

     

    We can also Choose the restriction level to Block web content automatically. The restriction level are categorized as .High .Medium .None .Custom . In custom level we need to choose content categories to block specific content.

     

    An option to Block File downloads can also be clicked in order to disallow downloads.

     

     2. Time Limits

     

    In this option we can Control when and at what Time our children will be using the computer.

     

     3. Games

     

    In this option we can control games by rating, content, or title by specifying whether the USER can be allowed to play games. If 'Yes' then we need to allow or block the games by rating and content types. This has to be done by Setting Game Ratings. Different type of ratings are available and the access to these Games will be allowed or blocked based on the Okayed Game Ratings which we require to set up. By default the ratings available in my Computer was supported by ESRB. Once this is set we can also Block (or Allow) any game on your computer by name.

     

     4. Allow and block specific programs

     

    In this we can specify the programs which can be used by the USER. When we specify these options we can Allow (or) block any programs on your computer. The available options are

    . USER can use all programs

    . USER can only use the programs I allow

     

    By default the first option is selected, but, if you require to specify and control only the programs which you allow, you need to select the second option. When the second option is selected a list of program will be shown from which you can select and Check the programs that can be used.

     

    After all the above options are set, Click ‘OK’ for the user and the Parental Control will be activated when the USER log on the computer.

     

     

    3. Problems faced with Parental Control in Windows 

    It would be more appropriate if I could explain what are the problems faced when trying to implement the Parental Controls and in enforcing it in the Home.

     Scenario for Typical Home

     

    I am a home user and recently purchased a Home PC with loads of OEM software and goodies and the OS was Windows Vista Home Premium. We both are working parents and have two children. Eldest son is High School Grader and youngest daughter is First Grader. We decide to share the Home PC and as recommended we started by creating individual User Account for everyone at home. This would mean default 1 (One) Administrator User Account and 4 (Four) Standard User Account with 2 (Two) to be set with Parental Controls. The default Administrator User Account would be assigned the first time when you start operating the computer.

     

    Logged in as Administrator I created, initially 2 (Two) Standard user account meant for us, the parents. Then, I started creating 2 (Two) Standard User Accounts with Parental Controls to be Clicked ’On’.

     

    Then for each user account I started Setting the individual Parental Controls respectively. I clicked the Parental Controls: 'On'.

     

    For Activity Reporting, I clicked ’On’ and frequency I selected for Activity Viewing initially was every day.

     

    Problem !! 

    As recommended, we created a Standard User Account for us Parents. We as User will be accessing the computer using our individual login id. The Administrator User will not be frequently used for log in and will be used mostly when installing application programs and when performing other set ups.

     

    We could not understand this .

    i) How and who will be assigned to view Activity reporting ?

    ii) How and why should an Administrator be assigned as a parent, to view Activity reporting of our Children?

    iii) Any other standard user also cannot be considered as a parent !!

    iv) Why as a parent using our individual User Account we are not able to view our Childs Activity Reporting and why we should use an Administrator Account?

     

     

    Finally, we decided to click ’Off’ for Activity Reporting, as we thought it may not be needed at this stage.

     

    Continuing further, we proceeded with setting the options for Windows Settings. The options chosen by us and problems faced are given category wise.

     

     1. Windows Vista Web Filter

     

    For setting this we entered our option, by turning this Filter ‘On’ by clicking ‘Block some websites or content’. We did not enter any specific websites as we were not sure which site contains what content. We decided to use the ‘Block Web Content Automatically’ and the default set rate as Medium. Downloads were not checked for blocking.

     

    Problem !! 

    1. We felt that we would be facing issues when downloading huge content using Web. We also will not be able to control on, which content is being downloaded, from where and whether it contains malware etc. But, instead of totally blocking all downloads we decided to leave this issue open.

     

    2. What will happen to the downloaded contents by Standard User which is available in the Public area and Disk space. ?

     

    3. For searching contents in Web and in controlling the Web search there had already been known issues. How can we control the objectionable content from being returned by the Web search engine ?

     

    4. How to stop irrelevant Advertisement content and Shopping sites not suited for my children ?

     

    5. Now, the big question is., how will the Web Site or content manager be able to decide to age of my children ? Search engines like Bing, Yahoo, Google obviously will not be able to check the age group.

     

    6. Why, as a Parent, I am not being notified for download requests?

     

    7. Why am I (Parent) not being allowed to decide what is the content of the downloads immediately after a download is completed?

     

    Finally we decided to leave everything to default.

     

     2. Time Limits

     

    This option seems to be Okay and we decided to leave it for now and did not set any Time Limits for accessing the computer.

     

     3. Games 

    Here, we had to specify which types of Games the USER (the user with Parental Controls) can play and this can be controlled by rating, content or title. Our chosen options was 'Yes', USER can play games. After which we have the option of choosing which type of games USER can play and choose whether we have to Allow (or) Block games by rating and content types. For this we have to Set the game ratings.

     

    First we have to choose whether USER can play games if the game does not have a rating. We clicked to . Allow games with no rating

     

    Then we have to specify which ratings are ‘Ok’ for USER to play. By default the rating is always positioned at 18+ or ADULTS ONLY rating. Then we have to choose which games has to be blocked based on the content it contains. We chose to retain the default values.

     

    Now, we have the option to 'Block or Allow specific games' . When we clicked this option we were shown the Games which came pre-installed by the Microsoft Games. Other games provided by the OEM did not show up in the list.

     

    Problem !! 

    1. Here also, the age of my children is not taken into consideration as it is not requested to be filled in by the parent.

     

    2. When games developed and rated by external agencies it is not available in the list of ‘Block or Allow specific games’.

     

    3. There is no way to identify that the software or application being installed belongs to the entertainment category or Games category.

     

    4. The UAC already defines that Administrator permission is required to install a new software. But, the activity reporting does not show the new application or games installed as the distinction between administrator and parent is not available.

     

    5. Why when installing a new software of unrated content the parent or administrator is not notified to identify the content and rate it accordingly ?

     

    6. Why am I (Parent) not being allowed to decide and rate the contents of entertainment or video content when no ratings are available ?

      

    4. Allow and block specific programs 

    In this we had to select the options whether to Allow or Block specific programs. We initially chose to Block some programs and allow the USER to run only the programs we allow. Okay, the computer took some time in displaying all the programs installed. We then had to click which programs are to be used by the User.

     

    Problem !! 

    1. The list of programs displayed were not in program groups as is normally shown in the Start Menu.

     

    2. The list included some programs which should not be present there at all. For example

     

    a) lot of files named setup.exe from locations including Install Shield

    b) shutdown.exe

    c) My Antivirus software (Norton) and all its executables

    d) On verifying with my Laptop I found that Touch Pad and its executables also

    showed up in the list.

     

    3. Application executable files from common shared locations were included in the list to be allowed to be blocked.

     

    4. Why am I not asked when I install a new application what type of application is it?

     

    Finally, we decided to select the default , .USER can use all programs

     

     

     

    Is any solution available to make the Parental Controls more parent friendly?

     

     

    2. Solution 

    If only we could make the Parental Control better addressing some of the problems.!

     

    1. We should understand that Administrator is and cannot be always take the role of a parent. When a parental control is being set for a standard account an exclusive link between Parent user account and Child user account is also required. When a parent user account is assigned to a child user account (with parental controls) then the parent should be able to view the activity reporting.

     

     

    2. When assigning Parental Controls to a Standard User Account the age group of the child for whom the control is being set up is required to be updated or filled in by the Administrator.

     

     

    3. When age group of the child is available more control on the search results can be made by blocking objectionable contents and blocking of irrelevant advertising content and shopping sites can be done. Only relevant web sites suited for the age can be visited by the user.

     

     

    4. Presently there are only two options to control downloads. Either to allow or block downloads. Instead of completely blocking so as to control the downloads from the web, a notification to download can be sent to the assigned parent. Then the parent can either allow or block the download, and meanwhile the child user (with parental controls) who started the download can be alerted that the download is in progress with priority.

     

     

    5. As a parent, whenever a download is completed the content rating has to be decided by me (Parent) and I should be allowed to update the same.

     

     

    6. Most importantly, access to the /User/Public space is decided by UAC and is depending on 'Authorized User Account'. I agree with this, but, what if the child user account is able to modify or delete the files already being shared by other users. This should not happen and requires guidance before the child user account can venture into /user/public space.

     

     

    7. In setting the Games rating, the default games ratings has to be selected based on the Age Group of the child user account, which the parent is supposed to enter when the parental controls are set 'On'.

     

     

    8. Any application or software before being installed has to classified as whether it is a Game, Entertainment or Software by the administrator (or) parent. This would always ensure that more control can be made available for games.

     

    9. When for an entertainment software, games or video no ratings for the content is available the parent (or) administrator should be allowed to decide and rate the contents.

     

    10. The Windows Media Center program can direct access to Servers(for TV/Video/Media) which has only content suited for the specified Age. This would be more appropriate and helpful instead of blocking the program itself. As a parent I will not object to a Cartoon movie, Superman movie or Spiderman movie from being watched if it does not require subscription.

     

    11. When Blocking or Allowing specific programs, the programs being listed should be displayed under Program Groups like the way it is appearing in start menu. This would make it more easy to identify the program. System(0) programs should not be shown.

     

    12. If the user is a Standard User with parental controls, the user Desktop should be void of programs which requires registration, warranty etc. This can be avoided by allowing the administrator to select the program icons to be displayed in the Desktop when creating a user account.

     

     

     

    The above solutions are only indicative of possible ways or means for problems referred to given in this document.

     

     

     

     

    Monday, August 3, 2009 10:45 AM