David_Bennett : Windows Parental Controls

Apple (uk) ad targeting Parental Controls

David_Bennett — Wed, 11 Apr 2007 02:42:46 GMT

Just wandering around on you tube and discovered an apple (uk) ad targeting parental controls, with the 'naughty step'. The Mac says something about blocking items being "isn't that what kids want to do?". The idea behind parental controls is to block good kids from running into bad stuff, I don't really see the built in parental controls as being that limiting. It does what parents have been asking us to do for a long time, allowing an easy mechanism to control web content. For a first run at Parental Controls is does a pretty good and comprehensive job. There are some things which could be fixed, like allowing for a system for setting a number of hours a week someone is allowed to use the computer rather than just the specific times they could log on. Another useful feature would be remote administration of the controls, so a parent from work could unblock sites or games for children to play/look at. With this ad, apple is barking up the wrong tree especially since they have their own parental control features.

Still, apple like a good tree to bark up especially if they can make the tree look like something else.

Reading WPC logs in C#

David_Bennett — Fri, 30 Mar 2007 23:31:06 GMT

Here is a conversion of the WPCEvents.h file that is used with the vista SDK to get the parts of the various crimson events converted into c#. I have written about this file before and how the parts are connected together and how all the numbers work. This is useful if you want to write c# code to read/write WPC events.

It uses a set of enums to encompass all the values, the values are copied directly from the c++ headers.

using System;
using System.Collections.Generic;
using System.Text;

namespace WebCplHost
{
    /// <summary>
    /// The enums for the specific event ids.
    /// </summary>
    public enum WPCEvents
    {
        SettingChangeEvent = 1,
        GameStartEvent = 2,
        UrlVisitEvent = 3,
        EmailReceivedEvent = 4,
        EmailSentEvent = 5,
        MediaPlaybackEvent = 6,
        IMInvitationEvent = 7,
        IMJoinEvent = 8,
        IMLeaveEvent = 9,
        FileDownloadEvent = 10,
        IMFeatureEvent = 11,
        CustomEvent = 13,
        EmailContactEvent = 14,
        IMContactEvent = 15,
        AppBlockedEvent = 16,
        AppOverrideEvent = 17,
        WebOverrideEvent = 18
    }

    /// <summary>
    /// The indexes into the user settings for the setting chane event.
    /// </summary>
    public enum WPC_ARGS_SETTINGSCHANGEEVENT
    {
        CLASS = 0,
        SETTING,
        OWNER,
        OLDVAL,
        NEWVAL,
        REASON,
        OPTIONAL
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the AppBlockedEvent.
    /// </summary>
    public enum WPC_ARGS_SAFERAPPBLOCKED
    {
        TIMESTAMP = 0,
        USERID,
        PATH,
        RULEID
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailReceivedEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILRECEIEVEDEVENT
    {
        SENDER = 0,
        APPNAME,
        APPVERSION,
        SUBJECT,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        ATTACHCOUNT,
        ATTACHMENTNAME,
        RECEIVEDTIME,
        EMAILACCOUNT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailSentEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILSENTEVENT
    {
        SENDER = 0,
        APPNAME,
        APPVERSION,
        SUBJECT,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        ATTACHCOUNT,
        ATTACHMENTNAME,
        EMAILACCOUNT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailContactEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILCONTACTEVENT
    {
        APPNAME = 0,
        APPVERSION,
        OLDNAME,
        OLDID,
        NEWNAME,
        NEWID,
        REASON,
        EMAILACCOUNT
    }

    /// <summary>
    /// This is the values to use for the MEDIATYPE field in the
    /// WPC_ARGS_MEDIAPLAYBACKEVENT.
    /// </summary>
    public enum WPC_MEDIA_TYPE
    {
        OTHER = 0,
        DVD,
        RECORDED_TV,
        AUDIO_FILE,
        CD_AUDIO,
        VIDEO_FILE,
        PICTURE_FILE,
        MAX
    }

    /// <summary>
    /// This is the values to use for the EXPLICIT field in the
    /// WPC_ARGS_MEDIAPLAYBACKEVENT.
    /// </summary>
    public enum WPC_MEDIA_EXPLICIT_TYPE
    {
        FALSE = 0,
        TRUE,
        UNKNOWN
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the MediaPlaybackEvent.
    /// </summary>
    public enum WPC_ARGS_MEDIAPLAYBACKEVENT
    {
        APPNAME = 0,
        APPVERSION,
        MEDIATYPE,
        PATH,
        TITLE,
        PML,
        ALBUM,
        EXPLICIT,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the MediaDownloadEvent.
    /// </summary>
    public enum WPC_ARGS_MEDIADOWNLOADEVENT
    {
        APPNAME = 0,
        APPVERSION,
        MEDIATYPE,
        PATH,
        TITLE,
        PML,
        ALBUM,
        EXPLICIT,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMInvitationEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONINITEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        REQUESTINGIP,
        SENDER,
        REASON,
        RECIPCOUNT,
        RECIPIENT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMJoinEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONJOINEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        JOININGIP,
        JOININGUSER,
        REASON,
        MEMBERCOUNT,
        MEMBER,
        SENDER
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMLeaveEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONLEAVEEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        LEAVINGIP,
        LEAVINGUSER,
        REASON,
        MEMBERCOUNT,
        MEMBER,
        FLAGS
    }

    /// <summary>
    /// This is the flags to use in the MEDIA_TYPE setction of the WPC_ARGS_IMFEATUREEVENT
    /// when reading it out of the crimson logs.
    /// </summary>
    public enum WPCFLAG_IM_FEATURE : uint
    {
        NONE = 0x00,
        VIDEO = 0x01,
        AUDIO = 0x02,
        GAME = 0x04,
        SMS = 0x08,
        FILESWAP = 0x10,
        URLSWAP = 0x20,
        SENDING = 0x80000000, // Top bit means sending or receiving.
        ALL = 0xFFFFFFFF
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMFeatureEvent.
    /// </summary>
    public enum WPC_ARGS_IMFEATUREEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        MEDIATYPE,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        SENDER,
        SENDERIP,
        DATA
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMContactEvent.
    /// </summary>
    public enum WPC_ARGS_IMCONTACTEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        OLDNAME,
        OLDID,
        NEWNAME,
        NEWID,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the GameStartEvent.
    /// </summary>
    public enum WPC_ARGS_GAMESTARTEVENT
    {
        APPID = 0,
        INSTANCEID,
        APPVERSION,
        PATH,
        RATING,
        RATINGSYSTEM,
        REASON,
        DESCCOUNT,
        DESCRIPTOR,
        PID
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the FileDownloadEvent.
    /// </summary>
    public enum WPC_ARGS_FILEDOWNLOADEVENT
    {
        URL = 0,
        APPNAME,
        VERSION,
        BLOCKED,
        PATH,
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the UrlVisitEvent.
    /// </summary>
    public enum WPC_ARGS_URLVISITEVENT
    {
        URL = 0,
        APPNAME,
        VERSION,
        REASON,
        RATINGSYSTEMID,
        CATCOUNT,
        CATEGORY
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the CustomEvent.
    /// </summary>
    public enum WPC_ARGS_CUSTOMEVENT
    {
        PUBLISHER = 0,
        APPNAME,
        APPVERSION,
        EVENT,
        VALUE1,
        VALUE2,
        VALUE3,
        BLOCKED,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the WebOverrideEvent.
    /// </summary>
    public enum WPC_ARGS_WEBOVERRIDEEVENT
    {
        USERID = 0,
        URL,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the AppOverrideEvent.
    /// </summary>
    public enum WPC_ARGS_APPOVERRIDEEVENT
    {
        USERID = 0,
        PATH,
        REASON
    }
}

Log Viewer, behind the scenes

David_Bennett — Sat, 03 Mar 2007 02:04:48 GMT

The log viewer in Parental Controls reads in the public available system logs and turns them into the data you can see in the control panel. The logs are brought in from a couple of places, the System logs, the Application logs and the Parental controls log itself. These logs are manipulated in various ways to find the information in the viewer itself.

I am not documenting the event numbers for the parental control log itself in this post, since this information was posted up on my blog previously.

The web, im, email, media, system clock changes, account changes and changes to settings logs are all 1 to 1 correspondants into the logs itself. One entry in the log file ends up being one entry in the log viewer.

The Applications run log is generated by reading the applications log and matching start PIDs with end PIDs to find the duration the app ran for. These are then cached as well so that the game events can use this information to get the durations for their logons. It uses the events SE_AUDITID_ETW_PROCESS_CREATED and SE_AUDITID_ETW_PROCESS_EXIT to do the matching.

The game log uses the parental controls game event, which logs a PID the game ran as. This PID is then looked up in the stored list of apps run from the application log to match the time it ran for. The system looks for logs that are close to the time the game started with the right PID.

Logon times are generated from the system logs, matching the login times with the logoff times. The logon events are logged with a LOGONID which can be matched in the both of the events to make sure you have the right logon and logoff event to get the times right. This also deals with cases where there are overlapping logons (runas counts as a logon event). This uses the events SE_AUDITID_ETW_BEGIN_LOGOFF, SE_AUDITID_ETW_LOGOFF and SE_AUDITID_ETW_SUCCESSFUL_LOGON. It uses two log off events because windows generates one of them in some cases and one in the other.

Failed logon attempts are filtered to display the correct output. WIndows generates a failed login attempt every time someone opens up the control panel and looks at the user list and every time someone opens up the parental controls panel, viewing the hub page. This is because the way to check for blank passwords is to try and login with a blank password. So the the logs are filtered to try and find the failed logins that are not generated by the various control panels and are real failed login attempts. This problem should be addressed in the next version of windows, adding an API specifically to find if the password is blank or not. The logon failures are logged into the system log with the log id of SE_AUDITID_ETW_LOGON_FAILURE.

The account changes are not manipulated, but the logs of the type SE_AUDITID_ETW_USER_CREATED, SE_AUDITID_ETW_USER_DELETED, SE_AUDITID_ETW_USER_DELETED and SE_AUDITID_ETW_LOCAL_GROUP_REM are processed to find which users are added/deleted as well as which users have been added into the administrators group.

Parental Controls used by everyone

David_Bennett — Wed, 21 Feb 2007 21:54:00 GMT

Looks like Bill Gates is using parental controls for his children these days, nice to see that people within the company are buying off and using the technology as well. We have had a surprisingly small amount of negative press on the parental controls issues so far. Seems to be one of the things that people really like in Vista.

Parental Controls and Press Coverage

David_Bennett — Sat, 10 Feb 2007 00:37:59 GMT

We have had a lot of good press coverage from Parental Controls over the past few days, which has been great. Bill Gates and various other people have been pressing it as one of the main reasons to upgrade to Vista, I think it is a very good reason to upgrade if you are worried about your children's safety on the net. The system provides a lot of useful easy controls to make it easier to make sure your child is safer. Of course no system is completely fool proof and there will always be some things that have not yet been plugged up.

The New York Times says "But some of the most powerful new features in Vista are not for hard-core players at all. Instead they are aimed at casual players and, most important, at families. It is not overreaching to say that if you have young children who play computer games or use the Internet you are basically remiss if you do not upgrade to Vista as soon as possible.", which is a nice endorsements of our product.

While most of all the press on the subject has been good, there have been a few negative pieces on the web here and there. There were the comments I talked about previously about the system feeling overwhelming for a parent to use, although really I don't think this is the case for most of what the system does. There is also the stuff Alex St John has written about vista and parental controls. He does make some reasonable points, it is true that ESRB licensing is expensive and not likely to be obtained for downloadable content. This is being fixed though, by ESRB, so that downloadable games can be rated in a reasonable fashion. His comments on the elevation dialog are silly, you want the system to ask if you really want to install something. It should be saying this, since otherwise it might be installing something you don't want it to (like spyware). It is also possible to set the rating on each game seperately so you don't need to use the rating system to achieve this. This article covers the points he brings up quite well too.

Making a Game marked as run in Parental Controls

David_Bennett — Sat, 03 Feb 2007 01:03:51 GMT

For a game to show up in Parental Controls as being run a few things need to happen. First the game must have a GDF file so it will be properly registered with the Game Explorer. Once the game is correctly registered with the Game Explorer it will show up in the Games folder under the Vista start menu. If a game is not recognised by Game Explorer it will not show up there.

Once the game is correctly registered, sometime during startup the VerifyAccess function must be called on the IGameExplorer Com object. This function will return a TRUE or FALSE value in the *pfHasAccess boolean passed into the function. The game must use this boolean to determine if the game can startup or not. The game will get automatically locked down using ACLs once it is blocked. The VerifyAccess call is also where the event is logged into the parental controls log system to say the game was started and run. When the activity viewer shows the information it co-ordinates the information out of the application run log with the game event so the VerifyAccess function must be called in the executable that is actually the main game, not the bootstrap executable.

I previously covered some information about GDF files in this blog.

Overwhelmingness of Parental Controls?

David_Bennett — Wed, 31 Jan 2007 07:26:00 GMT

There have been some comments about various aspects of Parental Controls being overwhelming, specifically in this post. It is true that some of the existing parental control companies will not be so keen on some features, however there is a lot of area for new features and things that are missing from Vista parental controls to be expanded into, like https filtering.

Looking at the overwhelming aspects, the main problem feature there is the application overrides. This is difficult to setup for parents unless you know something about how the programs are layed out on the computer. Sadly there is not really much we can do about this, it is a difficult problem to solve. I think this is one feature that most parents will not use, or will turn on and not know how to use it then turn it off again. Game settings I don't think are that overwhelming, the ability to change the rating system is there but it is not easy to get at and most parents will most likely not even know the option exists. The default setting will be set to the rating system for the area windows is sold in.

The logs are very useful, the problem there is how to present the information about things like web sites visited in a way that is easy to understand. For time constraint reasons we only did a very simple web log viewer in Vista, this is an area that third party tools could be useful. Writing an enhanced log viewer for the vista parental controls. All of the logs are in the Crimson logs as outlined in other sections of this log.

Overall I think that parents will use all of the features (including the activity reports) with the exception of application restrictions.

Summary of Vista Parental Controls Features

David_Bennett — Wed, 31 Jan 2007 03:37:00 GMT

Short summary of Windows parental control features:

Game Restrictions – ability to restrict games based on ratings and on descriptors associated with the game. These are based on ESRB ratings, and other rating systems from other countries.
Application Restrictions – ability to disable all programs from running on the machine, except specifically allowed programs.
Time Restrictions – ability to restrict what hours the child can use the computer for
Web Restrictions – ability to restrict which web sites can be browsed, based on the content of the page.
Activity reporting – ability to see what you child has been doing, which web sites are browsed, which games and applications are run as well as things like failed logon attempts to see for password hacking attempts and system clock changes to get around the time restrictions.

HTTP Extension for Windows Parental Controls

David_Bennett — Tue, 30 Jan 2007 01:27:00 GMT

To make Windows Parental Controls work better with browsers and other programs that support http, the filter in vista sends back a custom error number when the page is blocked. This number is 450, an app can recognise this error code and display a blocked message or allow for overrides to be done based on the url that was blocked. This is how IE recognises blocked content and shows a gold bar to allow the user to override the urls blocked on the page. Firefox has plans to support this as well. WPC will recognise the various versions of http and return a header that is correct for each different version, from 0.9 upwards.

Opening up the WPC Control Panel from the command line

David_Bennett — Tue, 23 Jan 2007 23:07:00 GMT

It is possible to open up the windows parental controls control panel from the command line, well any control panel. You pass in the name of the control panel to open up and it opens it up. Nice and easy. For the parental controls panel the syntax is:

Control.exe /name Microsoft.ParentalControls

Different exclusion lists

David_Bennett — Fri, 19 Jan 2007 22:51:34 GMT

There are 4 different exclusion lists in Windows Parental Controls that are used to control which programs and which urls are allowed to be connected to. The two main lists are the HttpExemptionList and the UrlExemptionList, these are modifiable lists than can be added to by installation programs to put themselves into the excluded programs list or to allow specific urls. There are also two read only lists, the WinHttpEmptionList and the WinUrlExemptionList, these lists contain programs and urls that cannot be added or removed using WMI. They are inbuilt system programs and urls that are required for the system to operate correctly.

You can see all four lists through the WMI interface, I showed you how to see the first two lists in a previous blog entry. Displaying the second two is the same thing, just using the other WMI entry names. I updated the script to also show the windows readonly blocked items.

Here is the output from the script:

App Exmemption list:
C:\Program Files\Windows Media Player\Wmpconfig.exe
C:\Program Files\Windows Media Player\Wmpshare.exe
C:\Program Files\Windows Media Player\Wmpnetwk.exe
C:\Program Files\Windows Media Player\Wmpsideshowgadget.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\Wmpenc.exe
C:\Program Files\Windows Media Player\Wmlaunch.exe
C:\Program Files\Windows Media Player\Wmpnscfg.exe
C:\Program Files\Windows Media Player\Wmprph.exe

Windows (readonly) App Exmemption list:
C:\Windows\eHome\MCUpdate.exe
C:\Windows\HelpPane.exe
C:\Windows\eHome\ehrec.exe

Url Exmemption list:
http://drmlicense.one.microsoft.com
http://preview.services.wmdrm.windowsmedia.com
http://services.wmdrm.windowsmedia.com

Windows (readonly) Url Exmemption list:
http://go.microsoft.com/fwlink/
http://games.metaservices.microsoft.com
http://images.metaservices.microsoft.com
http://www.microsoft.com/library/media/1033/windowsvista/images/shield.png
http://oca.microsoft.com
http://wer.microsoft.com
http://www.microsoft.com/windowsvista/images/lockedout_uncompressed48.png

Here is what the script looks like:

// Setup some defines for the rest of the script, points to the local machine
// and the parental controls namespace.
strComputer = ".";
strRootNamespace = "\\ROOT\\CIMV2";
strNamespace = strRootNamespace + "\\Applications\\WindowsParentalControls";

// Connect to WMI and get the system settings object.
strConnectStr = "winmgmts:\\\\" + strComputer + strNamespace;
sysSettings = GetObject(strConnectStr + ":WpcSystemSettings=@");

// APplication exemptions (don't ask why this is a HttpExeptionList).
list = sysSettings.HttpExemptionList;
if (list != null) {
strExemption = "App Exmemption list:\n";
// Get the indexes and move through the array to print it out.
for (str in list.toArray()) {
     strExemption = strExemption + " " + list.getItem(str) + "\n";
}
} else {
strExemption = "No app exemptions defined.\n";
}

// Show the path to the new instance.
WScript.Echo(strExemption);

list = sysSettings.WinHttpExemptionList;
if (list != null) {
strExemption = "Windows (readonly) App Exmemption list:\n";
// Get the indexes and move through the array to print it out.
for (str in list.toArray()) {
     strExemption = strExemption + " " + list.getItem(str) + "\n";
}
} else {
strExemption = "No app exemptions defined.\n";
}

// Show the path to the new instance.
WScript.Echo(strExemption);

// Url exemtpions.
list = sysSettings.UrlExemptionList;
if (list != null) {
strExemption = "Url Exmemption list:\n";
// Get the indexes and move through the array to print it out.
for (str in list.toArray()) {
     strExemption = strExemption + " " + list.getItem(str) + "\n";
}
} else {
strExemption = "No url exemptions defined.\n";
}

// Show the path to the new instance.
WScript.Echo(strExemption);

// Url exemtpions.
list = sysSettings.WinUrlExemptionList;
if (list != null) {
strExemption = "Windows (readonly) Url Exmemption list:\n";
// Get the indexes and move through the array to print it out.
for (str in list.toArray()) {
     strExemption = strExemption + " " + list.getItem(str) + "\n";
}
} else {
strExemption = "No url exemptions defined.\n";
}

// Show the path to the new instance.
WScript.Echo(strExemption);

Parental Controls on a Domain

David_Bennett — Fri, 12 Jan 2007 23:20:54 GMT

It is possible to turn on parental controls if your machine is on a domain, but default it is disabled. It is not possible to turn on parental controls for Business skews of Vista since parental controls is not present on the machine at all in these skews of the operating system. If you are using Windows Ultimate and have your machine joined to a domain you can enable parental controls by using a group policy setting. Even though it is posssible to turn on parental controls on a domain, it is only possible to apply parental controls to non-domain users. So you can only turn on parental controls for local machine users and not users on the domain.

To edit the group policy settings you go into the control panel and into the Administrative Tools section to the 'Edit Group Policy' control panel. This will require elevation and you need to be elevated to do this. Inside the Group Policy Object Editor, you go to Computer Configuration/Windows Settings/Windows Components/Parental Controls. Inside this section there is a group policy option called 'Make Parental Controls control panel visible on a Domain'. Enable this option and you will be able to get the Windows Parental Controls control panel and turn on parental controls for users on the machine.

Adding a URL Exemption in c#

David_Bennett — Sat, 06 Jan 2007 01:08:00 GMT

The system contains a list of applications which are exempted from parental controls. This list can be accessed via WMI and it should be modified in the install process for any application that requires free Internet access. The way to do this is to access the class via WMI and add the specified program into the list of app's. Here is an example written in C# to do just this.

There are two properties on the WMI object which have to do with the application exemption list. There is the HTTPExemptionList and the WinHTTPExemptionList, the HTTPExemption list is the one that is used to add in extra programs. The WinHTTPExemptionList is a readonly property that cannot be changed, it has some internal system exemptions.

using System;
using System.Collections.Generic;
using System.Text;
using System.Management;

namespace AddUrlExemption
{
    /// <summary>
    /// Class which has all the system settings for WPC stored in it.
    /// </summary>
    public class SystemSettings
    {
        private ManagementObject _systemSettings;

        /// <summary>
        /// Default constructor, makes a new system settings WMI object.
        /// </summary>
        public SystemSettings()
        {
            _systemSettings = new ManagementObject(
                    @"root\CIMV2\Applications\WindowsParentalControls",
                    "WpcSystemSettings=@",
                    new ObjectGetOptions());
        }

        /// <summary>
        /// The application overrides in existance on the system. THis allows the
        /// application overrides to be set and retrieved.
        /// </summary>
        public List<string> AppOverrides
        {
            get
            {
                string[] urls = (string[])_systemSettings["HTTPExemptionList"];
                List<string> ret = new List<string>();
                foreach (string url in urls)
                {
                    ret.Add(url);
                }
                return ret;
            }
            set
            {
                string[] setting = new string[value.Count];
                int pos = 0;
                foreach (string url in value)
                {
                    setting[pos] = url;
                    pos++;
                }
                _systemSettings["HTTPExemptionList"] = setting;
            }
        }

        /// <summary>
        /// Saves the system settings back into the system.
        /// </summary>
        /// <returns>the management path of the saved object</returns>
        public ManagementPath Save()
        {
            return _systemSettings.Put();
        }
    }

    /// <summary>
    /// Main program to call the class.
    /// </summary>
    class Program
    {

        /// <summary>
        /// Prints the string list of app overrides.
        /// </summary>
        /// <param name="list">the list to print</param>
        static void PrintAppOverrides(List<string> list)
        {
            foreach (string s in list)
            {
                System.Console.WriteLine(" " + s);
            }
        }

        /// <summary>
        /// Adds in a new override into the list.
        /// </summary>
        /// <param name="args">the command line args</param>
        static void Main(string[] args)
        {
            SystemSettings setting = new SystemSettings();
            List<string> appOverrides = setting.AppOverrides;
            System.Console.WriteLine("Start Overrides:");
            PrintAppOverrides(appOverrides);
            appOverrides.Add("c:\\windows\\bfsrv.exe");
            setting.AppOverrides = appOverrides;
            setting.Save();
            System.Console.WriteLine("Added: c:\\windows\\bfsrv.exe");
        }
    }
}

GDF Xml file format

David_Bennett — Sat, 18 Nov 2006 04:25:00 GMT

The GDF file is an xml file associated with games in vista. The file gives information about the various ratings associated with the game along with the name of the game. The XML file format is fairly simple and is as follows:

<GameDefinitionFile>
    <GameDefinition>
        <Version>
            <VersionNumber versionNumber="x.y.y.y" />
        </Version>
    <Name>name of game</Name>
    <GameExecutables>
        <GameExecutable path="xyz.exe" />
        ...
    </GameExecutables>
    <Ratings>
        <Rating ratingId='<rating guid>' ratingSystemID='<rating system guid>'>
            <Descriptor descriptorID='<descriptor guid>' />
        </Rating>
        ...
        </Ratings>
    </GameDefintion>
    ...
</GameDefinitionFile>

Here is a simple C# class to read in and parse a GDF file. It assumes you are given an xml file as an input.

using System;
using System.Collections.Generic;
using System.Text;
using System.Xml;
using System.Data.SqlClient;
using WpcData;

namespace WpcGames
{
    class GDFFile
    {
        List<GameDefinition> _games;

        public GDFFile(XmlDocument doc)
        {
            _games = new List<GameDefinition>();
            // Lets go through this and do some happy parsing.
            foreach (XmlNode node in doc.ChildNodes)
            {
                if (node.Name == "GameDefinitionFile")
                {
                    ParseGDF(node);
                }
            }
        }

        internal List<GameDefinition> Games
        {
            get { return _games; }
        }

        private void ParseGDF(XmlNode list)
        {
            foreach (XmlNode node in list.ChildNodes)
            {
                if (node.Name == "GameDefinition")
                {
                    Guid gameId = new Guid(node.Attributes["gameID"].Value);
                    //Guid wmid = new Guid(node.Attributes["WMID"].Value);
                    Guid wmid = Guid.Empty;
                    GameDefinition def = new GameDefinition(gameId, wmid);

                    _games.Add(def);

                    ParseGameDefinition(def, node);
                }
            }
        }

        private void ParseGameDefinition(GameDefinition def, XmlNode node)
        {
            foreach (XmlNode child in node.ChildNodes)
            {
                if (child.Name == "Version")
                {
                    foreach (XmlNode inner in child.ChildNodes)
                    {
                        if (inner.Name == "VersionNumber")
                        {
                            def.Version = inner.Attributes["versionNumber"].Value;
                        }
                    }
                }
                else if (child.Name == "Name")
                {
                    def.Name = child.InnerText;
                }
                else if (child.Name == "Ratings")
                {
                    ParseRatings(def, child);
                }
            }
        }

        private void ParseRatings(GameDefinition def, XmlNode node)
        {
            foreach (XmlNode child in node.ChildNodes)
            {
                if (child.Name == "Rating")
                {
                    Guid RatingID = new Guid(child.Attributes["ratingID"].Value);
                    //Guid SystemID = new Guid(child.Attributes["ratingSystemID"]);
                    def.Ratings.Add(RatingID);
                    ParseDescriptors(def, child);
                }
            }
        }

        private void ParseDescriptors(GameDefinition def, XmlNode node)
        {
            foreach (XmlNode child in node.ChildNodes)
            {
                if (child.Name == "Descriptor")
                {
                    Guid DescriptorID = new Guid(child.Attributes["descriptorID"].Value);
                    def.Descriptors.Add(DescriptorID);
                }
            }
        }
    }
}

.net Binding for WPC Events

David_Bennett — Thu, 26 Oct 2006 23:40:00 GMT

The WPC event system logs a series of events to the WPC crimson channel. The channel contents is viewable inside the log viewer and it has a path of: Microsoft-Windows-ParentalControls/Operational. The events are logged with a variety of different parameters, mostly you can see what they are from inside the event viewer itself. Of the logs in the system, the ones that are logged by default are SettingChangeEvent (logged by the WPC system), Game Start Event (logged by the gameux system), Url Visit Event (logged by the WPC system), Media Playback Event (logged by Media Player), File Download Event (logged by IE), AppOverrideEvent (logged by the WPC system), WebOverrideEvent (logged by the WPC system) and AppBlockedEvent (safer events copied from the insecure application log).

The logs are mostly as you would expect, the web and app override events are generated by the over the shoulder allowing of specific web sites, when it pops up the elevation dialog box and allows you to allow or block the url/app on the spot. The other events in the wpc log are not currently logged by any existing application and will require logging from the apps themselves. This log format is not going to change in the future though, so logging these events will mean they will show up in the next versions of WPC as well.

The following code is a series of constants that allow you to reference the various parts of the crimson logs easily. The enum WPCEvents is used to look at the eventid of the crimson log to see which of the wpc events it is referring to. The other enums are used to index into the user array of events when querying the crimson logs, to get the correct values out.

The enum of WPC_MEDIA_TYPE and WPC_MEDIA_EXPLICIT_TYPE are used when looking at the values for the MEDIATYPE and the EXPLICIT fields in the the media playback event.

The enum of WPCFLAG_IM_FEATURE is used to determine which features the IMFEATUREEVENT refers to. The feature event is logged for several different types of log events and this mask determines which type they are. It is legal for this mask to contain multiple flags to mark that this event is for multiple event types.

The enum of WPCSettings is used to look at the SETTING name inside the SETTINGSCHANGEVENT to figure out which of the settings is being changed. This is a number to make the setting localizable correctly.

using System;
using System.Collections.Generic;
using System.Text;

namespace OneCareService
{
    /// <summary>
    /// The enums for the specific event ids.
    /// </summary>
    public enum WPCEvents
    {
        SettingChangeEvent = 1,
        GameStartEvent = 2,
        UrlVisitEvent = 3,
        EmailReceivedEvent = 4,
        EmailSentEvent = 5,
        MediaPlaybackEvent = 6,
        IMInvitationEvent = 7,
        IMJoinEvent = 8,
        IMLeaveEvent = 9,
        FileDownloadEvent = 10,
        IMFeatureEvent = 11,
        CustomEvent = 13,
        EmailContactEvent = 14,
        IMContactEvent = 15,
        AppBlockedEvent = 16,
        AppOverrideEvent = 17,
        WebOverrideEvent = 18
    }

    /// <summary>
    /// The indexes into the user settings for the setting chane event.
    /// </summary>
    public enum WPC_ARGS_SETTINGSCHANGEEVENT
    {
        CLASS = 0,
        SETTING,
        OWNER,
        OLDVAL,
        NEWVAL,
        REASON,
        OPTIONAL
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the AppBlockedEvent.
    /// </summary>
    public enum WPC_ARGS_SAFERAPPBLOCKED
    {
        TIMESTAMP = 0,
        USERID,
        PATH,
        RULEID
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailReceivedEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILRECEIEVEDEVENT
    {
        SENDER = 0,
        APPNAME,
        APPVERSION,
        SUBJECT,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        ATTACHCOUNT,
        ATTACHMENTNAME,
        RECEIVEDTIME,
        EMAILACCOUNT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailSentEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILSENTEVENT
    {
        SENDER = 0,
        APPNAME,
        APPVERSION,
        SUBJECT,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        ATTACHCOUNT,
        ATTACHMENTNAME,
        EMAILACCOUNT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the EmailContactEvent.
    /// </summary>
    public enum WPC_ARGS_EMAILCONTACTEVENT
    {
        APPNAME = 0,
        APPVERSION,
        OLDNAME,
        OLDID,
        NEWNAME,
        NEWID,
        REASON,
        EMAILACCOUNT
    }

    /// <summary>
    /// This is the values to use for the MEDIATYPE field in the
    /// WPC_ARGS_MEDIAPLAYBACKEVENT.
    /// </summary>
    public enum WPC_MEDIA_TYPE
    {
        OTHER = 0,
        DVD,
        RECORDED_TV,
        AUDIO_FILE,
        CD_AUDIO,
        VIDEO_FILE,
        PICTURE_FILE,
        MAX
    }

    /// <summary>
    /// This is the values to use for the EXPLICIT field in the
    /// WPC_ARGS_MEDIAPLAYBACKEVENT.
    /// </summary>
    public enum WPC_MEDIA_EXPLICIT_TYPE
    {
        FALSE = 0,
        TRUE,
        UNKNOWN
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the MediaPlaybackEvent.
    /// </summary>
    public enum WPC_ARGS_MEDIAPLAYBACKEVENT
    {
        APPNAME = 0,
        APPVERSION,
        MEDIATYPE,
        PATH,
        TITLE,
        PML,
        ALBUM,
        EXPLICIT,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the MediaDownloadEvent.
    /// </summary>
    public enum WPC_ARGS_MEDIADOWNLOADEVENT
    {
        APPNAME = 0,
        APPVERSION,
        MEDIATYPE,
        PATH,
        TITLE,
        PML,
        ALBUM,
        EXPLICIT,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMInvitationEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONINITEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        REQUESTINGIP,
        SENDER,
        REASON,
        RECIPCOUNT,
        RECIPIENT
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMJoinEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONJOINEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        JOININGIP,
        JOININGUSER,
        REASON,
        MEMBERCOUNT,
        MEMBER,
        SENDER
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMLeaveEvent.
    /// </summary>
    public enum WPC_ARGS_CONVERSATIONLEAVEEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        LEAVINGIP,
        LEAVINGUSER,
        REASON,
        MEMBERCOUNT,
        MEMBER,
        FLAGS
    }

    /// <summary>
    /// This is the flags to use in the MEDIA_TYPE setction of the WPC_ARGS_IMFEATUREEVENT
    /// when reading it out of the crimson logs.
    /// </summary>
    public enum WPCFLAG_IM_FEATURE : uint
    {
        NONE = 0x00,
        VIDEO = 0x01,
        AUDIO = 0x02,
        GAME = 0x04,
        SMS = 0x08,
        FILESWAP = 0x10,
        URLSWAP = 0x20,
        SENDING = 0x80000000, // Top bit means sending or receiving.
        ALL = 0xFFFFFFFF
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMFeatureEvent.
    /// </summary>
    public enum WPC_ARGS_IMFEATUREEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        CONVID,
        MEDIATYPE,
        REASON,
        RECIPCOUNT,
        RECIPIENT,
        SENDER,
        SENDERIP,
        DATA
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the IMContactEvent.
    /// </summary>
    public enum WPC_ARGS_IMCONTACTEVENT
    {
        APPNAME = 0,
        APPVERSION,
        ACCOUNTNAME,
        OLDNAME,
        OLDID,
        NEWNAME,
        NEWID,
        REASON
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the GameStartEvent.
    /// </summary>
    public enum WPC_ARGS_GAMESTARTEVENT
    {
        APPID = 0,
        INSTANCEID,
        APPVERSION,
        PATH,
        RATING,
        RATINGSYSTEM,
        REASON,
        DESCCOUNT,
        DESCRIPTOR,
        PID
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the FileDownloadEvent.
    /// </summary>
    public enum WPC_ARGS_FILEDOWNLOADEVENT
    {
        URL = 0,
        APPNAME,
        VERSION,
        BLOCKED,
        PATH,
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the UrlVisitEvent.
    /// </summary>
    public enum WPC_ARGS_URLVISITEVENT
    {
        URL = 0,
        APPNAME,
        VERSION,
        REASON,
        RATINGSYSTEMID,
        CATCOUNT,
        CATEGORY
    }

    /// <summary>
    /// The indexes into the user settings part of crimson for the CustomEvent.
    /// </summary>
    public enum WPC_ARGS_CUSTOMEVENT
    {
        PUBLISHER = 0,
        APPNAME,
        APPVERSION,
        EVENT,
        VALUE1,
        VALUE2,