Parental Controls : restricted-access accounts have Admin privileges

[Hayton]

Does anyone else see this or is it only my setup that's strange?

Edit : My setup was strange. There's still a small problem but not as originally reported here. See the post further down.

In Security Center only someone with Administrator privileges can change firewall and other settings, which is as it should be.

Parental Controls, though, allows anyone in a restricted-privilege account to act as an Administrator and set or change passwords, restrict or remove access to websites and impose or remove other restrictions - even if that account has previously been classed as a Child Account.

It seems that this is a problem that's been around for a while, as discussed in this thread from 2009-10 (which, btw, I've now locked). Posters in that thread said it was necessary to log in as an Admin first before starting up a user account for a child, but that this could easily be circumvented by rebooting the machine. The situation I see is slightly different, but it does seem that if there is not an active Admin-privilege account which is registered with Parental Controls actually running then a Child Account can act as Administrator - which can't be right.

This will be mentioned in the next conference call, but it'll probably get a low priority for fixing.

Message was edited by: Hayton - reinsert link - on 23/06/12 18:51:35 IST

Message was edited by: Hayton on 23/06/12 22:41:26 IST

Message was edited by: Hayton - problem partly resolved - on 26/06/12 02:24:02 IST

[exbrit]

Don't use them but your link doesn't work.

[Hayton]

A salutary reminder to test changes .... link now fixed.

[exbrit]

Those people had the version of software that doesn't include Parental Controls.

Message was edited by: Ex_Brit on 23/06/12 2:14:55 EDT PM

[Hayton]

I don't know how that got in there .....

There were several threads about Parental Controls not working correctly back around 2010. Everything was supposed to be fixed in the 2010 version. Perhaps it was, but there's a new or old bug in that part of the McAfee suite. I can only conclude that all the kids have worked this out and are keeping very quiet about it

https://community.mcafee.com/thread/19090

https://community.mcafee.com/message/111696#111696

and especially

https://community.mcafee.com/message/1065#1065

[exbrit]

,,and none sorted out it would appear.    Tsk Tsk.   Let's see what the Conference Call brings on Monday.

[Hayton]

It's not as bad as it looked earlier. After Unprotecting all the accounts and starting over from scratch in the main Admin account with new passwords and re-designating the user accounts as Child accounts, I cycled through those accounts to see what access they now had. They can't assume Administrator privileges, which is fine, but each Child account can access the Administrator password-setting screen and the edit-settings page, and there seems to be no limit on the number of password-guessing attempts that are allowed. If the password-hint option has been taken up it might be possible to guess the password eventually, using the clue provided.

So the subject header is incorrect. They don't have Admin privileges, but there's nothing built-in to the program to prevent a Child account from resetting all the Parental Controls. I would have expected the program to disable those options for any account that was not itself an Administrator account.

This isn't a major problem then. It requires a slight modification rather than a major code rewrite. As for whether things will have changed after a reboot, I won't know until there is a reboot. I suspect not. This looks like a different issue from the one reported in the earlier thread.

[exbrit]

Are the Child accounts also Limited or Standard (depending on the OS) Accounts in Windows itself?  

[Hayton]

Yes. It's how things would normally operate where more than one member of a family has access to the same PC : parent has an admin account, a child has a user account with restricted privileges.

I can't say how this would work in a home network, which is probably how many families operate - a separate PC/laptop/whatever for the child, but with the parent controlling how the network is set up. If anyone has any thoughts on this it would be interesting to see how effective the enforcement of access controls is in a network. Or perhaps Parental Controls isn't suitable for that environment? Maybe that's what Family Protection is for.