Limited Administrator Rights Windows 7

Question

Looking at getting my son a new laptop for Christmas so he doesn't have to use my wife's when he needs to do schoolwork/surf, etc.

The old laptop is Vista, this one will be Windows 7 (hooray), but I want him to have as much access as possible, but limit his access in some ways.

I want to limit some of the sites he can visit using parental controls, but at the same time leave him free to install games, utilities, etc. I don't want him visting adult, warez, MP3 sites, etc.

I know at some jobs I work at, they implement a Local Security Policy that leave my access open except for some things (like editing screen saver for example).

Is this possible in a Windows 7 Home Premium machine without a domain server on the network? I know I could restrict some sites at the router, but that doesn't help if he takes the computer to a friend's house.

What are some other solutions for this very real problem?

Answer 1

you can use OpenDNS to filter acces to certain websites.

Here are some OpenDNS video tutorials:

Using OpenDNS for adult site filtering and online safety

If you're using Windows 7, refer to the Windows Vista section.

Answer 2

Home edition is pretty limited in an administrative way (therefore doing anything through Windows policies are probably not even as useful as they would in commercial versions), but Home editions of Windows do focus on "family" friendly management. Have you checked out Family Safety?

NOTE: the restrictive policies you are referring to are called Group Policies and are generally applied at a Group, computer and OU level on the servers. If you want to tinker around with those type of settings on a Local level, check out these:

Restricted Sites in IE (but they could then use Firefox to bypass IE restrictions)

Or you could always go 3rd party, NetNanny, commercial, with easier interfaces and more capabilities directed solely on such features. Check out the Family Safety first though.

Answer 3

I know this is an old post but I thought this might be helpful to anyone coming here. I too just purchased 2 laptops for my 2 boys for their birthdays. Both have windows 7 which allows much more parental control. Open dns is nice, but doesn't control browser search pages for me. In other words, they can still read a list of sites in a google search with small icons of nude, sex, etc. when doing a key word search, even though they might not be able to access the offensive page itself. instead, I found K9 web filtering was best and can be downloaded at http://www1.k9webprotection.com/. It is free and easy to set up. I use "high" filtering setting and choose which pages they can actually go to. The I also use keyword filtering because I found some pages were still showing up. I can enter a whole list of keywords into the word box and it stops these kind of pages dead. For instance, if I wanted them to stop accessing "Lego" pages, I would just enter lego in the word field.

I use windows 7 parental control/ time limits to make them get off of the computer at the same time every night and it works. I prefer to "block" the time that I don't want them to be on.

I also removed internet explorer from the system by going into the remove program tool and choosing to remove windows programs-internet explorer from the list. I did this because firefox is the main browser we use because it is more secure and I didn't want internet explorer popping up when they clicked on sites. The boys once found a workaround to my restrictions by going into the program files and clicking on the internet explorer link directly.

To allow any program to work for them that I want to work, I right click on the folder of the program I want to allow, (this must be done from the administrator's desk, not the user desk), and choose "run with administrator rights." This is for those programs that will not run automatically in their user desk.

Their desk is passworded so they can't just get on anytime they want. It's a little inconvient but I unlock their computer every time it is needed-my boys will abuse their time and spend it all on the computer. I use work time in the mornings. Afternoons are for computer time.

Unfortunately, I have not discovered a way yet to allow my sons to "experiment" with installing programs and such without administrative rights so i figure,if they want to do that then I must be present with them when they do it using the administrative desk.