Parental Controls Dilemma (W8.1)

Discussion in 'other software & services' started by new2security, Sep 12, 2014.

  1. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492
    Just finished setting up my sister's laptop that has Windows 8.1 pre-installed.

    I've tried to adhere to my own idea of a good security policy when deciding what security layers the computer should have, e.g ; UAC max, restricted user account, firewall, default deny execution from users/appdata/local, EMET, weekly scanning with Windows Defender and Google Chrome as browser of choice.

    Since it's not equipped with Windows 8.1 Pro version, I've used the built-in parental controls allowing only certain programs to run.

    Now, every time an update for Google Chrome is out it always changes the name of the directory/folder name and this doesn't work well with Parental Controls since the new folder name isn't recognized against its white list. I have to manually allow several Google software in order for Chrome to upgrade and run. This isn't a big deal for me, just a nuisance really, but for my sister it can be troublesome.

    I'm more or less forced to either teach my sister the cumbersome steps to allow Parental Controls to update Chrome and run it, or disable Parental Controls in order to gain automatic updates.

    What would you do?
     
  2. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,080
    Location:
    USA
    The parental controls are nice (I use them on Win 7.) I would hate to see you turn them off. On Win 7, the parental controls allow the white list to be the executables themselves (like chrome.exe.) It's not tied to the location. Is this a possibility for Win 8?

    If that's not doable, would some remote desktop connection like TeamViewer work to allow you to get in and update her machine for her? (I have never tried this so it may not work.)
     
  3. MrBrian

    MrBrian Registered Member

    Joined:
    Feb 24, 2008
    Posts:
    6,032
    Location:
    USA
  4. Mayahana

    Mayahana Banned

    Joined:
    Sep 13, 2014
    Posts:
    2,220
    You want to set policies, then enforcement of those policies as someone else pointed out. You can also setup a remote support/monitoring package on her system, and use scripts to control what you want, and if necessary uninstall things from remote. Although that would take a good bit of technical knowledge/experience to accomplish.

    Wouldn't BlueRidge Appguard, setup properly be good in this situation?
     
  5. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492
    I haven't dug any deeper into how Parental Control works in W7 and W8 so I don't know if that should work. My understanding is that the white list is always tied to the location? E.g. I can only browse for executables to be added on the white list, and in the new folders created by Chrome (e.g.

    How do you set it up on W7?
    You never get those questions from Parental Controls when Google Chrome auto updates?

    In Program Files (x86)\Google\Update folder the Googleupdate.exe is whitelisted but apparantely upon a new update, a new folder is created (currently 1.3.24.15) which also contains a Googleupdate.exe. This one I have to allow/deny everytime. Chrome's subfolders are a mess.

    Remote suppoert : Great tip but I don't plan to update the computer remotely. At least that's the last solution.
     
    Last edited: Sep 16, 2014
  6. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492
    Thanks for the link and advice. I've used Pretty Good Security in the past but with Firefox. Not sure how the update works with PGS or Software Policy. Will look into it! Thanks.
     
  7. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492
    I tend to agree with you. I will most likely have to abandon the idea of only using the built-in software in Windows. Remote administration will be difficult.

    @Thank you all for the input. I will first look into if Parental Controls somehow may be able to manage the Chrome updates seamlessly, if not I'll look at third-party software.
     
    Last edited: Sep 16, 2014
  8. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,080
    Location:
    USA
    In my initial reply, I thought I was white listing executables by name only, independent of the folder path where they are located. It seems that my memory was in error and that the path does matter. I don't have access to a Windows 8 machine all that much. I checked online and it appears that the application white list procedure for Windows 8 is very similar to Windows 7. So, this means that my first plan won't help you.

    Sorry for the confusion!
     
  9. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492
    No problem, good to establish what limits there are in Parental Controls.
    As far as I can see, W7 and W8 use same parental control features.
    I can then assume you don't use Chrome?
     
  10. HAN

    HAN Registered Member

    Joined:
    Feb 24, 2005
    Posts:
    2,080
    Location:
    USA
    I am the only user on my PC. I normally do 99.9% of my surfing under my Standard User account which has the application Parental Controls turned on.

    Firefox is the main browser I use (inside Sandboxie.) But Chrome is set as my default browser. (I don't care for IE and I really don't want it to ever come up. Thus the Chrome default setting.) Due to habit, I usually check for updates every week or so from my Admin account (by going to the Chrome menu and clicking on About Google Chrome.) If there is one, that will launch the update process.

    I will try to pay attention to the update procedure closer and see if it will still update under the Standard User account without me taking any action. I'll report back any results that might prove helpful.
     
  11. new2security

    new2security Registered Member

    Joined:
    Aug 8, 2008
    Posts:
    492

    Ok, that's probably an easier way to solve the issue, by asking them to right click Chrome and run-as admin. Not sure if this would work since an update will still make a folder with a new name. I will also keep a closer eye on this!

    Thanks.
     
Loading...