Windows 10 Parental Control Settings

I received a significant amount of feedback from my recent post on how to setup parental controls with iOS 10 (available here), so I decided to follow on with another post on how to setup parental controls with Windows 10.  While Microsoft has had some good parental control features with Windows 7, when Windows 10 first arrived Microsoft took a step backwards. Luckily, Microsoft recently restored and even improved their parental control settings for Windows 10.

Parents looking to administer their child’s Windows 10 computer will need to create a Microsoft account if they don’t already have one.  Children will also need to have Microsoft accounts in order to link their computers with the family parental control settings.  You can navigate here to create the accounts for you and your family.  These accounts will also include email accounts registered to the @outlook.com domain.

After creating your Microsoft account, login to your account and then navigate to: https://account.microsoft.com/family. Now go to each Windows 10 computer that your children use and make sure they are setup with their own individual accounts.  Kids should never share accounts or use parent’s accounts when online for a variety of reasons.  You also want to make sure kids don’t have administrative accounts, but rather standard user accounts.

If you child has their own account, log in to their account.  If they don’t have their own account, log in with the administrative account and navigate to the control panel, then Accounts:

Once you have accessed the accounts page, you will be able to add a family member.  Remember that any adults should already have Outlook.com Microsoft accounts now and so should any children.

Reminder, your kids should never know administrative passwords or parent passwords.  If kids can login as a parent or administrator, they can bypass everything that is about to be setup.

I have redacted the names of my family for privacy purposes, but you would normally be able to see everyone’s name and their avatar (if uploaded to Outlook.com).  As I have done in my family, I recommend that you add all children to all devices. This way kids have no excuse to share passwords and when they do access other devices, the settings will follow them.  If you use the newly created outlook.com Microsoft accounts to login to computer accounts accounts, it will allow the use of single sign-on (SSO), meaning that the same password used to access the outlook.com Microsoft account will also work to login to the computer.

When you add children and parents, they will receive an invite to their outlook.com email address.  Once they accept, you will see their accounts populate on the computer.  Now that you have accounts for parents and kids on any computer you are setting up, the next step is to configure security settings.  For anything that supports multifactor authentication (MFA), I can’t stress enough how important it is to enable it.  Microsoft does support the use of the Google Authenticator app, which is highlighted in my blog post referenced previously.  While this doesn’t have to do with parental controls, it is important enough to run through in this post.  If you want to learn more about MFA in general, I have a full post here.

To setup MFA, login via a browser to your Microsoft account.  Once you are logged in, select the link in the top banner for “Security & privacy.”

Next, click on the “More Security Settings” link:

The next page you will be taken to has multiple security settings, all of them important.  I also recommend adding your phone number and a secondary email address where you can receive alerts about suspicious activity with your account, especially if you are not planning on using the outlook.com email as a primary email account.  In the below screenshot, the red arrow shows where to go to setup MFA.

To configure security settings for child accounts, navigate back to the account homepage and click the “Family” link in the top banner.  You can also navigate directly to the family section by going to https://account.microsoft.com/family#/ once signed in.

You should see all of the parents and kids that have been setup on the next page.

Microsoft allows parents to check on the recent activity of their kids, to add money to their accounts for app and in-app purchases, manage screen time, and whitelist/blacklist websites.  Just as I mentioned in my iOS parental control blog, I highly recommend whitelisting URLs instead of blacklisting.  If a master list of URLs is maintained, they can easily be copied and pasted into Microsoft settings and the same URLs used for iOS devices.  The whitelisting of specific URLs was one of the items Microsoft had with Windows 7 parental controls but originally removed for Windows 10.  Thankfully, Microsoft restored that functionality.

After clicking on a child, several options will appear.  Under the recent activity link, you will see the ability to turn on activity reporting and have those reports emailed to a parent on a weekly basis.  Additionally, I recommend disabling InPrivate browsing on kids computers.  InPrivate browsing allows a user to navigate websites without the computer keeping a trail of sites visited.  Be aware that this setting only works with Microsoft’s builtin Edge browser, but if you don’t install any other browsers and kids are not administrators on the computer allowing them to install their own browsers, this should not be an issue.

To setup web browsing settings, click on the “Change settings” link.  You will be taken to the below screen, where parents can opt to block inappropriate websites.  This will force SafeSearch to be on for things like Google image searches and will do its best to filter out inappropriate search results.  To whitelist specific websites, you will also need to check the box at the bottom of the screen that says, “Only see websites on the allowed list.”

If whitelisting is enabled, parents have the ability to enter domain names into “always allow these” (whitelisting) and “always block these” (blacklisting).  An example screenshot is below.

After web browsing has been configured, the next area to setup is screen time.  Parents can set a schedule for computer usage, e.g., only between the hours of 8:00 a.m. and 8:00 p.m. and select what days of the week those schedules apply to.  Additionally, parents can block computer usage for an entire day and set screen time limits within the hours that are allowed.  For example, a parent may allow no computer use on Sunday and when it is allowed a child can have no more than 1 hour per day, maximum.  I have tested this and it works very well, no matter what a child is doing on the computer, when the time limit is up, they are logged out.  Windows only suspends their session, so no data is lost and they can request additional time which can be approved either via Microsoft’s website or directly on their computer by logging in with a parent’s password.

If your child’s device happens to be a mobile device, such as a Windows tablet or surface, you also have the option of turning on tracking so parent’s can see where their child’s device is physically located at any time.  This is much like the Find my iPhone app on iOS devices.

And finally, if you need to check on the permissions of your kids, navigate back to a parent’s Microsoft account and click on the “Security & privacy” link in the top banner.  Next, click on the link titled “Manage my child’s account permission.”

The “View family settings” will just take you back to the family page we have already discussed in this post.  The link to edit a child’s personal information will show you the name, date of birth, location, and other information listed for your child. Unless absolutely required for some reason, I recommend leaving as much blank as possible.  The date of birth and name are required, however.  You can also manage a child’s access to third party apps, which will let them connect their Microsoft account to other websites or apps (much like people do when they use their Facebook login to access other websites).  This will show you any apps they have already connected with and parent’s can revoke if necessary.  And then there is the nuclear option of completely revoking consent for a child.  This will kill all of their access to anything.