Enabling Parental Controls on a Domain-Joined Machine

Today I stopped in the hallway to chat with a colleague of mine, Lorrin Maughan, about Parental Controls, as she's an expert on the topic. (You may have read Lorrin's earlier posts about Consumer Photo Features and Ultra Mobile PCs on this blog.) The question came up as to whether Parental Controls would remain in effect if you were to join your computer to a domain -- for instance, the corporate network here at MS (or maybe you run a domain controller at home). If you're a system administrator, you probably already know that Parental Controls is disabled when you join your Windows Vista PC to a domain. This is because it’s a consumer feature not generally designed for use in domain-joined scenarios. Since many of us here at MS use our production laptops for demonstrations as well, we were previously required to hack the registry in order to re-enable Parental Controls after joining the domain. Otherwise, a demonstration of Parental Controls was impossible. But now that Group Policy is broadly enabled on the Windows Vista builds we're using, a simple modification to the Management Console will change it back.

Here's an example of how you would modify Group Policy to re-enable Parental Controls after joining a domain (the Microsoft corporate network, in this case):

• Open gpedit.msc
• Navigate to Local Computer Policy/Computer Configuration/Administrative Templates/Windows Components/Parental Controls
• Enable the one setting there
• You will likely need to log out of and back into the domain for the setting to take effect

The above is meant to serve only as an example -- your particular domain may be differently managed -- but hopefully it gives you an idea of the level of control provided both Group Policy and Parental Controls in Windows Vista.