- \n
- Create a new account.
\n![\"pc1\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc1-300x203.png\")
<\/a><\/li>\n- Tick the box to mark it as child’s account
\n![\"pc2\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc2.png\")
<\/a><\/li>\n- You are done.<\/li>\n
- You can go to Account \/ User settings and set up the Family Safety options + activity reporting. By default, it’s all enabled.
\n![\"pc3\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc3-300x186.png\")
<\/a><\/li>\n<\/ol>\nTesting<\/h5>\n
- \n
- Simply log off as a current user and log on as a child’s account<\/li>\n
- What you will immediately see after logging on is a notification in the right corner of the screen saying ‘This account is monitored by Family Safety’
\n![\"pc4a\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc4a-300x118.png\")
<\/a><\/li>\n- Run a couple of apps
\nNote: I didn’t test the web sites in this test; I am not 100% sure, but setting modification are probably traced as well – it’s all subject to further research
\nIn my case I ran:<\/p>\n- \n
- cmd.exe, from there I ran calc.exe and spawned another copy of cmd.exe<\/li>\n
- In the new cmd.exe I ran notepad and again, started a new instance of cmd.exe<\/li>\n
- In the final cmd.exe instance, I launched mspaint\/pbrush.exe<\/li>\n
- Eventually I also launched Task Manager via CTRL+SHIFT+ESC<\/li>\n
- I ran it this way hoping that PID relationship will be preserved
\n![\"pc8a\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc8a-300x177.png\")
<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ol>\nAnalyzing the evidence<\/h5>\n
- \n
- I then logged off and logged on as Admin user to review the logs<\/li>\n
- I went to the User Settings again and… saw this:
\n![\"pc9\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc9-300x177.png\")
<\/a><\/li>\n- That was surprising \ud83d\ude42<\/li>\n
- I started Process Monitor and went back to the logs.<\/li>\n
- Luckily, Process Monitor highlighted a file of interest:
\nC:\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-ParentalControls%4Operational.evtx<\/li>\n- Now it was easy. I opened it up in MMC:
\n![\"pcA2\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pcA2-300x170.png\")
<\/a><\/li>\n- Looks like the Built-in reviewing panel ignores some Windows applications.<\/li>\n
- While reviewing the data in MMC I noticed the events are NOT sorted according to time (granularity of time is too low and all timestamps are ‘equal’; this is kinda… stupid)<\/li>\n
- Exporting to CSV and TSV doesn’t help as timestamps are truncated to granularity of seconds<\/li>\n
- Exporting to XML does help as timestamps are preserved with fractions e.g. 2015-03-03T17:21:49.447501700Z so we can use it to sort events properly<\/li>\n
- You can export the logs to an XML file via command line using wevtutil
\nwevtutil qe \/lf “c:\\Windows\\System32\\winevt\\Logs\\Microsoft-Windows-ParentalControls%4Operational.evtx” > xml<\/li>\n- Once you parse this data and cherry-pick what you need you can end up with a table as below (I loaded it into Excel and sorted it by time):
\n![\"pcB\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pcB-300x61.png\")
<\/a><\/li>\n<\/ol>\nNice! So we got the log of all applications loaded during the test and following the sequence as listed earlier.<\/p>\n
The SerializedApplication column contains a serialized pair of a full path to an executable followed by the window title of the application. The serialization seems to be based on an alphabet made up of 0-9a-z and each string is prefixed with two characters that represent the length of the string.<\/p>\n
The best is to explain it via examples:<\/p>\n
000000000000000000000000000000000000111111111111111111111111111111111111\r\n 0123456789abcdefghijklmnopqrstuvwxyz0123456789abcdefghijklmnopqrstuvwxyz\r\n05Paint\r\n07Notepad\r\n0nFirst Sign-in Animation\r\n0pWindows Command Processor\r\n0vc:\\windows\\system32\\notepad.exe\r\n17c:\\windows\\system32\\oobe\\firstlogonanim.exe<\/pre>\n
I am not sure what TimeUsed means (or, more precisely – how to interpret this value).<\/p>\n
Configuration<\/strong><\/h5>\n
Parents can specify what apps can be ran by a child. There is also a way to block content according to rating & only allow certain list of websites (web filtering). In other words, it can work as a (kinda primitive) security control to limit access to both web sites and applications. Other options include time limits and game usage restrictions.<\/p>\n
Configuration of Parental Control is preserved under the following key:<\/p>\n
- \n
- HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls<\/li>\n<\/ul>\n
![\"pcC\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pcC-300x122.png\")
<\/a><\/p>\nAdding filters for web means that the entries will be created under the following key:<\/p>\n
- \n
- HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\<SID>\\Web\\Overrides<\/li>\n<\/ul>\n
![\"pcd\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pcd-300x67.png\")
<\/a>And similar rules apply to apps:<\/p>\n- \n
- HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\<SID>\\DesktopApps<\/li>\n<\/ul>\n
![\"pce\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pce-300x67.png\")
<\/a><\/p>\nWith the filtering on, we got yet another artifact to look at which may be handy in determining what applications have been used on the system and when.<\/p>\n","protected":false},"excerpt":{"rendered":"
One of the lesser known features of Windows 8 was an introduction of Parental Control. The idea is that you can change an account type to one that can be used by children. Such account can be then both managed … Continue reading
- HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\<SID>\\DesktopApps<\/li>\n<\/ul>\n
- HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Parental Controls\\Users\\<SID>\\Web\\Overrides<\/li>\n<\/ul>\n
- Run a couple of apps
- Tick the box to mark it as child’s account
![\"pc1\"](\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2015\/03\/pc1.png\")
<\/a><\/li>\n