Technical Note - Windows Vista Parental Controls Review

February 2007

This is an initial review of the Parental Controls supplied in Microsoft Windows Vista as tested in the Netsweeper labs. This report will be updated with further testing and experience. Your comments are welcome: please email your comments, questions, or experiences with Vista Parental Controls to feedback@netsweeper.com.

Versions support

Microsoft has introduced a built-in parental controls tool in both Windows Vista home basic and home premium editions. The feature doesn’t require any additional installs and comes turned off by default. The Parental Controls weren’t designed to work in business environments as explained in the MSDN blog[i]: Q. What SKU's will parental controls be in? A. Parental Controls will be available in all consumer SKU's, including Starter [Basic] Edition and Ultimate. It will NOT be in any of the business SKU's nor server SKU's. While we recognize that some of the Parental Controls functionality could be desirable in a business environment, they have not been architected to work optimally in those environments. Parental Controls in Windows Vista is tailored to family usage in homes.Brian Trenbeath Program Manager Windows Vista Parental Controls

Managing accounts

Windows Vista Parental Controls is dependent on the creation of a Windows user account for each computer usage profile needed. In order to avoid well known filtering circumvention techniques, it’s not possible to activate any level of parental control on an Administrator account. There are still some widespread applications which don’t work very well with the Windows Vista multi-user system. Netsweeper labs detected problems with applications such as Google Talk that simply don’t show up for any user other than the administrator which installed it. Since Parental Controls can only be enabled for non-administrator accounts, it is will be more important that software developers create software—particularly educational tools, games, and other programs designed for children—that work well for users with standard permissions rather than administrator permissions.

Features

Windows Vista Parental Controls features are combined in five different groups which can be configured independently for each user account. Web FilterThe web filter option allows the administrator to restrict websites to be accessed by the user account. The control can be done based on an allow-only list (white-list) and on the selection of 10 content categories (plus the “unratable websites” category). The ten categories are: \

Pornography
Mature Content
Sex Education
Hate Speech
Bomb Making
Weapons
Drugs
Alcohol
Tobacco
Gambling

Vista enforces the usage of its own version of Safe Search on the most popular web search engines (such as Google and Yahoo) when the Pornography and Mature Content categories are blocked. Two noticeable items: there’s is no indication of when Safe Search is on or off in the Parental Controls interface; and some of Netsweeper labs tests detected a lack of efficiency when compared with Google and Yahoo proprietary Safe Search options. It’s noticeable that three important categories for parental controls are not found among the list:

Proxies – HTTP proxies are proliferating quickly on the web using several different techniques to circumvent Internet filtering applications. Windows Vista doesn’t offer a specific category to block proxy and Netsweeper labs tests shown that the most popular web proxies can be used to browse pornography and any other category of contents.

Web Chat – Despite the recent growth of Instant Messaging, there are still thousands of web chat sites on the Internet and it’s important to allow parents a way to manage how their kids are using it. Besides Web Chat, there are several web based instant messaging applications that fall in the same Web chat category and are overlooked by Windows Vista. Netsweeper labs shown that access to the Web version of several Instant Messengers (including MSN Messenger, Google Talk and ICQ) can be done with no restrictions.

Profanity – For a family market, blocking sites that freely use profanity makes sense to catch the sites that may not fall into other categories but are clearly not family-friendly.

Time limits

The ability to limit access to the PC is done intuitively through a weekly calendar. The feature doesn’t restrict only the Internet usage but the PC usage. Someone might need to stay up a little late to finish a homework assignment, and it would be useful to allow them to have access to the PC, but just not to the Internet.

Games

Windows Vista brings the ability to control which games can be played based on several rating systems such as the ESRB system (Entertainment Software Rating Board). Games can be blocked based on the ratings they receive from the ESRB varying from “Early Childhood” to “Adult Only”. Games can also be blocked based on their content or individually on a one-by-one basis.

Allow and block specific programs

Through a list of all the applications installed on the computer, parents can choose which one can be used by each user account. The list is organized by folder and by default allows all the applications. It’s a little hassle to find the correct application to allow or deny when the list of installed software gets too big or when the specific application is installed in a non-intuitive named folder. This is the way Microsoft addresses allowing/denying access to applications (such as IM or P2P) that use Internet protocols.

Activity Reports

Windows Vista Parental Controls enables parents to track several activities of the managed user accounts. Once enabled, the activity reports allow parents to monitor the basic usage of the computer such as total time logged on, which applications have ran, games played, activities on media player, and so on. The Internet reporting tools can be a little disappointing due to the non-existence of graphics showing a high level data. The only information available regarding web browsing is a list of all the URLs browsed (or denied), which could easily reach tens of thousands in less than a week due to the number of objects downloaded on each page request. The way reports are presented can create some confusion due to the lack of meaningful information such as why a specific website was blocked. Netsweeper labs detected some possible failures on the integration of the Windows Vista Parental Controls with Windows Live Messenger and Windows Mail. One of the activity reports options allow parents to review Instant messenger chats and Email activity of the managed user accounts however after several tests with the latest releases of Windows IM and Email clients no activity was recorded to these logs.

Conclusions

Microsoft has clearly taken some steps forward with this version of their Parental Controls. And with those advances come some disappointments - that their efforts didn’t extend further. If the objective is to limit the use of the computer for young children, the Parental Controls will suffice. For a typical teenager, the parent is most likely going to turn off most of the controls and rely on reports. And parents will quickly tire of that. The filtering component is weak, but for the parent of young children under 9, it may be enough. The filtering is not robust enough for older children or for adults.

[i] http://blogs.msdn.com/uac/archive/2006/04/06/570560.aspx#572802

Case Studies

iG - Internet Generation

Netsweeper works with Brazil's largest ISP to provide a secure content filter to its customers.

print this page
Email this page | Netsweeper email this page