Windows 10: Bypass Family Settings by conversion to Local Account

I just upgraded all my computers to Windows 10.

My 15 year old is clever enough to bypass the (new) Family settings controlled Microsoft Account I just set up for him by converting the account to a local account. This seems to let him play as long as he wants, without time restrictions. I didn't get an email about this, or any other notification. This is the second time he has done it.

Why is it so easy to completely bypass all the family safety settings it took me hours(!) to finally get set up?

Also the Family Recent Activity shown on my Microsoft Account web site doesn't seem to update itself. It is at least two or three days behind, perhaps more. How often does Recent Activity update? Is it supposed to be near instantaneous?

:)

 

Easy bypass to family protection by signing in with a local account

What stops the child signing in with a local account and bypassing all family settings?

 

My son by passing his Microsoft Family account

Hi how do I stop my son setting up a local account without my permission and bypassing is Microsoft Family account

 

What you describe should be impossible. To test this I just now created a child account on my PC and signing in to it tried to change it to either an admin account or a local account. Could not do that.

The only way your son can change his account to a local account and "remove" it from Family, or create a new account is to have access to an admin account on that same PC (your account), or alternatively access to your admin MS account's Family settings online. For that he needs both your MS account username and password. It means that if you protect your own personal admin account (MS account) with a strong password and especially the Two-Step Verification, he has no way to access that account and he should not be able / is not able to change your Family settings or his account status.

 

This is Windows 10 - when I create new local accounts, I only see "admin" or "standard" type of accounts. What do you mean when you say "child" account?

I upgraded the PC from Windows 7 (that had local family control features that, while limited, at least functioned as advertised). So all the accounts came from that upgrade.

The account in question was a standard local account, that I converted to a "Microsoft account" for a child, because that is the only way in Windows 10 to get family settings controls. I see it in my Family settings online, and can (apparently) control screen time, etc. When I log in to it on the computer and go to Settings, I also see I have the ability there to return it to a local account.

All of this without any access to my admin account at all. I can take a video of the entire process from start to finish, here if you need convincing. It would probably be about a 45 minute video, what with all the confirmation codes, creating garbage emails just for Microsoft, etc.

Also, please answer my other question regarding the rate of updates to family settings "recent activity". Is it once a day, once a week, whenever the activity report is emailed???

Thanks for looking into this. I would appreciate it if you would not dismiss it as user error.

 

I assumed that you had created a child (family) account, not creating a local normal account then converting it.

In your case I would simply copy his personal stuff to an external backup drive, remove his account and start from scratch. Takes a few minutes but in doing so you get better control.

When you have removed his account, this is Phase 1 in recreating a controlled child account to him: Child Account - Add or Remove from Your Family in Windows 10 - Windows 10 Forums. When done, restore his personal content to respective folders under his user profile folder.

Doing this he has no way to switch to a local account.

Then, the more you have patience to read, the more practical tips you will get:

• Family Settings - Manage for Child in Windows 10 - Windows 10 Forums
• Family Member - Allow or Block using a PC in Windows 10 - Windows 10 Forums
• Family Child - Manage Screen Time Settings - Windows 10 Forums
• Family Child - Manage Activity Reporting Settings - Windows 10 Forums
• Find Your Child in Microsoft Family on a Map - Windows 10 Forums
• Family Child - Add Money to Account for Windows Store - Windows 10 Forums
• Family Child - Manage Apps, Games Media Settings - Windows 10 Forums
• Family Child - Manage Web Browsing Restriction Settings - Windows 10 Forums

 

Thanks Kari.

I copied their User folders so I could restore them later.
I deleted their accounts on the computer.
I removed them from my Microsoft Account "Family" online, to "start from scratch".
I went to "Settings" on my PC and added them as a child account.
I logged into their email and accepted the Family request.
I then logged into their new child account. Before restoring their User folders.

Guess what? They can still log in with a local account.

This "local account" option that lets them bypass child controls so easily seems to be sticky. As if it is stored with the Microsoft Account. That I needed to create in Windows10. To enable child settings control.

I guess nobody at Microsoft thought of the use-case of somebody upgrading from Windows7 to Windows10 with EXISTING child accounts.

What would you suggest now? Create NEW, DIFFERENT Microsoft accounts using other garbage emails?

 

If it matters, there is another computer downstairs on which they also have Microsoft accounts.

 

Not personally using Family accounts (multiple time divorced, no kids *Wink) I had to ask an expert's opinion in this. Here's what he answered, direct quote from a message:

Note: the above in situation where the Child account is created "by the book", not converting a local account to an MS account first.

 

Does it still create activity reports if it is a local account?

In order to block a program, they need to run the program, and I need to see it in the activity report. So if the local account doesn't create activity reports then blocking programs is effectively disabled. This is why my son made the change - so I couldn't block Planetside2.

 

It is also why I asked how often Microsoft updates user activity. As near as I can tell, it isn't very often.

 

I will check something on a test machine, will post when done. I have an idea which in theory should work, I need to test it first to be sure.

Might take an hour or two, need to install Windows 10 first on that machine.

 

It was faster as I expected, the test confirmed my theory was right. Doing this your kid has absolutely no way to switch to a local account and leave the MS Family:

1.) Start as told earlier, creating the Child account as a Family account
2.) Sign the Child once in to Windows, sign out and back in to your admin account
3.) Press Win + R to open the Run dialog, type netplwiz and hit Enter to launch the advanced user control panel
4.) Select the Child account, click Properties:




5.) Change the Child account's user group from Users to Guests:




6.) Close the Properties, close advanced user control panel

That's it. Users in Guest group cannot open and use the Settings app, therefore they cannot change the account type (switch to a local account).

Pros:

• User cannot change any settings, not even open the Settings app
• User can still download and install desktop software but when doing so, the PC admin credentials will be asked

Cons:

• To change any settings, an admin user must first change the Child's usergroup back to Users, sign in to Child account, change the required setting, sign out from the Child account, and finally set the user back to Guests group
• To download and install anything from the Windows Store, an admin user must first change the Child's usergroup back to Users, sign in to Child account, download and install software from the Windows Store, sign out from the Child account, and finally set the user back to Guests group
• OneDrive Desktop sync does not work on Guest accounts. To download, open or upload files in Onedrive the user must use a browser

 

You are a genius. I'm trying this when I get home.

 

Ok, I've been trying to get this to work for a while. Yes, the setting the child's account to a guest account does make the PC Settings impossible to set. All the PC settings, not just the conversion of "Microsoft accounts" to local accounts.

PlanetSide2 unfortunately does not run in a guest account. I've proven this by changing the account back and forth between standard and guest - PS2 runs in a standard account, but opens and immediately closes down in a guest account.

So the only way to let my son play the game he wants to play is to let him have a child account that Microsoft has designed so that the child can easily bypass all the Family Settings controls by resetting to a local account.

This is a bug. Someone at Microsoft really needs to fix it.