Web filtering keeps you a little safer

Web filtering keeps you a little safer

By Susan Bradley

Web-filtering services can provide additional security and protection from malware.

Several vendors now provide this valuable service.

Either you’ve heard the stories or you’ve experienced it yourself: a fully patched Windows machine gets infected by rogue-AV malware (a virus disguised as an antivirus app). Before anyone realizes that the “AV scanner” that popped up on the screen is an AV scam, the damage is done — and hours or even days are wasted removing the infection and repairing Windows.

In most cases, PC users who acquire this type of contagion share some of the blame. They make the mistake of clicking a malicious Web link — in an online search result, an enticing image on a seemingly innocent webpage, an ad for some free product, an e-mail, and so on.

Getting infected is especially annoying when you thought you’d fully protected yourself by regularly patching Windows, applications, Flash, Java, and browsers — along with your antivirus software.

If you’re wondering what else you could possibly do (short of pulling your connection to the Internet), I recommend adding Web-filtering services offered by DNS providers.

DNS providers offer free, personal Web filtering

Whenever your PC connects to an ISP, the company updates your gateway/router with the information it needs to connect with the ISP’s Domain Name Services (DNS) servers. (DNS is the process by which numeric website addresses are translated into website names you can understand — such as windowssecrets.com.) Along with DNS, some ISPs (such as Comcast) include Web filtering — also called content filtering — for additional security.

Setting up Web filtering lets you control what sites can be visited through your local browser. Good Web-filtering controls allow white lists (sites that should always be accessible — such as windowssecrets.com), black lists (banned sites), and category-based filtering. Apps that establish parental controls over Internet sessions typically use Web filtering. (In extreme cases, Web filtering is used by repressive governments to limit the sites their citizens can visit.)

If your ISP provider doesn’t offer Web filtering, you have another option. You can switch your DNS connection settings — either within Windows or on your router — from your ISP’s DNS servers to a third-party DNS provider.

Although several vendors provide this service for home and small-business users, OpenDNS is probably best known. It offers both a free service and a Home VIP solution that costs U.S. $19.95 a year. This paid solution (more info) can display charts and graphs of sites visited from your home computers.

Making the switch is relatively easy, as long as you can access your operating system’s network properties or your router’s setup utility. OpenDNS provides simple instructions on its site.

Another option is Symantec’s Norton ConnectSafe (site), which uses DNS-based filtering to block suspect sites. Like most content-filtering services, ConnectSafe uses site categorization, such as pornography, crime, gambling, and so forth. The easy-to-set-up service has three levels of filtering:

• Policy 1: This base-level filtering blocks malware, phishing sites, scam sites, and Web proxies. For this level, set your DNS entries to 198.153.192.40 and 198.153.194.40.
• Policy 2: Medium filtering adds pornography blocking. Set your DNS to 198.153.192.50 and 198.153.194.50.
• Policy 3: This stringent filtering blocks a host of sites that Norton ConnectSafe deems not family-friendly, filtering for mature content and other family-unfriendly content. To choose this filtering, use 198.153.192.60 and 198.153.194.60 (shown in Figure 1).

Once ConnectSafe is set up, you can visit its “Configure Router” page and click the “Test Norton ConnectSafe” button to ensure filtering is enabled.

Figure 1. Setting up Norton ConnectSafe in a 3Wire DSL modem

Norton ConnectSafe does not provide custom white/black listings. And with just filtering by category, there’s no guarantee that all objectionable sites or content will be blocked. Also, using the strongest filtering setting might block sites you want to visit or that aren’t objectionable to you. Before committing to ConnectSafe, test that the filtering isn’t too restrictive.

Another consideration: If you change DNS settings in Windows, it applies only to that machine. If you change settings in a router, it applies to all systems that connect to the Internet through that router.

An alternative to ConnectSafe is Dyn’s Internet Guide, which also uses site categorization. Internet Guide’s filtering options are more flexible than Norton’s; it offers predefined filter lists, category selection, and custom site white/black listings. As noted on its info page, you use 216.146.35.35 and 216.146.36.36.

Web/content filtering for small businesses

Small businesses now have fewer, or less attractive, DNS-filtering options. Beginning March 15, OpenDNS changed its DNS plans and no longer offers low-cost filtering for small businesses. Subscribers must choose between the Premium DNS plan (info page), which does not include filtering, or the OpenDNS Enterprise plan, which does includes filtering but at a significantly higher cost. The quote for my business was $1,500 per year to protect 1–50 users. The price increase prompted quite a bit of discussion on an OpenDNS Forums posting that announced the change.

For now, Norton DNS for Business is still free, as noted in a February post. DynDNS also offers free filtering for small businesses (info page). I’m evaluating both these offerings for my business, given the high price tag for OpenDNS.

When it comes to anything offered for free, one has to ask: Where’s the catch? There has to be something of value for the service providers. Most likely, both entities use the filtering process to gather information they can apply to their core business offerings. Symantec, for example, sees what websites customers visit. As noted on its privacy policy page, any data it might collect from site visits is discarded after two days. (It cannot view content sent over SSL connections.)

It might be cause for concern that an entity providing security solutions could see the sites you surf to. However, most — if not all — sensitive information should travel over SSL connections. So I’m OK lowering my paranoia a bit to ensure I continue to have objectionable websites filtered and blocked.

I’m convinced that using filtering has helped keep my home and small-business computers free of rogue antivirus and other malware posted on malicious websites. With so many threats coming from browser use, I see this as a security win — and not a privacy issue.

How to pass an audit (of your computer)

By Kathleen Atkins

You might be comforted to know that computers managing e-commerce transactions are typically certified. If a business accepts credit-card payments, its customers should know their information is secure on the e-commerce servers.

However, Lounge member WaterBoyz is not in the comfort zone yet: his Windows 7 computer was audited — with the report that its port 111 is open to the outside world.

How can this be? And how to fix it? WaterBoyz comes to the Security & Backups forum for assistance. Read here to see the advice he’s receiving. More»

The following links are this week’s most interesting Lounge threads, including several new questions to which you might be able to provide responses:

☼ starred posts — particularly useful

If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.

If you’re already registered, you can jump right into today’s discussions in the Lounge.

The Lounge Life column is a digest of the best of the WS Lounge discussion board. Kathleen Atkins is associate editor of Windows Secrets.

Manage mail — and life, too — in Outlook

You might be among the millions who can’t live without e-mail — or your Outlook calendar. But whether you’re in charge of your tools or they’re in charge of you is an open question. Just in time to save your sanity, Lothar Seiwert and Holger Woeltje have written Effective Time Management: Using Microsoft Outlook to Organize Your Work and Personal Life. This month, all Windows Secrets subscribers can download an excerpt from the book: Chapter 1, How Not to Drown in the Email Flood, which gives brisk advice for containing inbox overload. The chapter’s principles apply as well to most of the data and distractions that impede your progress throughout a day. If you want to download this free excerpt, simply visit your preferences page and save any changes; a download link will appear. All subscribers: Set your preferences and download your bonus Info on the printed book: United States

Stand back: performance packs a jolt

By Kathleen Atkins

What happens when a couple of electrical-engineering students ponder music? If they’re Eric Goodchild and Steven Caton, they build a couple of giant Tesla coils to serve as their own private rock stars.

Kindly, they share the performances with the Internet public. Enjoy a truly electric rendition of “Sweet Home Alabama.” Play the video

Shrink that gigantic WinSxS folder down to size

By Fred Langa

With its voracious appetite for disk space, WinSxS can be a problem for users of solid-state and other relatively small drives.

Fortunately, Win7’s little-known Deployment Image Servicing and Management tool can help regain gigabytes of space.

WinSxS folder too big for small drive

Reader Dave White is trying to make the most of his new solid-state drive’s (SSD) relatively limited space.

• “I wonder if you could discuss the ever-larger, WinSxS folder in Windows 7 again. You covered it a while back [May 14, 2009, item, “Huge WinSxS folder gobbles up disk space”], advising us to not fool with it. But I think it needs a revisit; it chews up more and more space on an SSD — for very little purpose.”I can’t move files out of the WinSxS folder, even as an administrator who’s taken ownership of the folder. How can I move these files to another drive for archiving?”

It’s possible — not guaranteed, but possible — to remove gigabytes of junk from the Windows Component Store (WinSxS) directory. However, manual deletion won’t work. You have to use a special command-line tool that’s built into Windows 7.

Before I go on, let’s quickly review the basics so we know we’re all on the same page.

The WinSxS system keeps libraries and backups of important DLLs and similar files. (I’ll call them all DLLs for the rest of this article, as shorthand.)

WinSxS first appeared in Vista but traces its lineage all the way back to System Protection in Windows ME. As such, WinSxS is the latest iteration of a well-evolved Windows stabilization feature.

Among other things, WinSxS is intended to remedy a problem once referred to as DLL hell — where different versions of a program require different versions of the same DLL. Updating to a newer DLL sometimes broke programs that required the older DLL version.

WinSxS lets Vista and Windows 7 keep and use different versions of the same DLL at the same time (thus the “SxS” for side by side). Each program can have exactly the DLL version it needs, solving many incompatibility issues. Also, older, backed-up DLLs are instantly — and automatically — available, should you need to roll back an update or uninstall software.

The stabilization benefits of WinSxS are real, and that’s why you shouldn’t fool with it without good cause.

Unfortunately, the downsides to WinSxS are just as real. All those multiple copies of DLLs and other files consume hard-drive space. The windowswinsxs folder can grow to 5GB, 10GB, or even more. The longer you use your system — especially the more software and updates you add — the larger the folder grows.

That’s not usually a problem on today’s large, standard drives, but on SSDs and other smaller devices, losing gigabytes of space to WinSxS can be a problem.

Unfortunately, as Dave found out, you can’t do a lot with files in the winsxs folder directly. It’s owned solely by the Windows TrustedInstaller service, and users — even Windows administrators — typically are not allowed to modify (delete, cut and paste, compress, etc.) WinSxS contents.

That said, if you, like Dave, have a serious space crunch, there are two ways to shrink the winsxs folder.

Eliminate obsolete backups: The first step is to eliminate any unneeded, large backup collections WinSys might contain. For example, if you have an original Win7 setup that you upgraded to SP1, your WinSxS folder probably contains several gigabytes of backup DLLs, system files, etc. from the original installation. If you’re not going to roll your system back to pre-SP1 conditions, you really don’t need these backups.

To root out these kinds of unneeded files, use Win7’s built-in Deployment Image Servicing and Management (DISM) tool. (Want DISM details? Start with this Microsoft screencast or this TechNet article.) On one of my systems, DISM shrank the WinSxS folder from 7.41GB to 4.89GB.

DISM isn’t magic, of course. On another Win7 system that had fewer updates and add-ons, DISM recovered no space at all. Still, DISM is free and takes only a few minutes to run, so it’s worth trying. Here’s how:

• Step 1. Make a full system backup.
• Step 2. In an administrator account, navigate to C:\Windows and right-click the winsxs folder. Select Properties and note the size of the folder. Close the Properties dialog box.
• Step 3. Click Start/All Programs/Accessories, then right-click Command Prompt. Select Run as administrator.
• Step 4.After the Command window opens, type (or copy/paste) the following command:

  C:\Windows\System32\DISM /online/Cleanup-Image/SpSuperseded

• Step 5. Let the process run to completion — it might take several minutes.
• Step 6. Recheck the size of the winsxs folder, as described in Step 1. With luck, you’ll see a significant space savings.

Uninstall what you don’t need: The only other effective way to shrink WinSxS is by uninstalling software. When you uninstall a program, any corresponding entries in the winsxs folder should be erased. That’s not always a practical — or satisfying — approach, but it’s really the only other safe way to shrink WinSxS.

But with luck, the DISM method will do the trick!

When Windows’ app installer misbehaves

L. Walker is having difficulty installing programs, and despite extensive research, he’s failed to find a solution.

• “Recently I have been experiencing a problem that I can’t solve. I am running Windows 7 Home Premium. My windows installer (msiexec.exe) will not install programs. I’ve searched the Internet for a solution, checked various forums, contacted technicians, tried System Restore, made sure I had no viruses or malware, etc., etc.”I was told I would probably have to reinstall Windows, but I don’t have a Windows installation CD and would certainly prefer to avoid reinstalling, if possible.”

The last time I answered this question (in a July 7, 2011, LangaList item) the best-available solution required a series of manual steps.

But I have good news! Microsoft recently inserted an automated, click-and-run Fix it tool into its MS Support article 2438651, “How to troubleshoot problems when you install or uninstall programs on a Windows-based computer.”

Try the Fix it first — just click it and follow the instructions. If that doesn’t work, the steps listed in the July 7 LangaList item, “Installer failure yields frustration,” are still valid.

Windows 8 Consumer Preview installation problems

Graham Smith was one of several readers who ran into snags while following the March 14 Top Story, “Step by step: How to safely test-drive Win8.”

• “I downloaded the Win8 consumer preview ISO and installed it into VirtualBox. I ran into a problem with the product key you published — it wouldn’t accept it.”I found several references to this problem on the Internet but no solutions. Finally, I found a posting for a different key and it worked just fine. Not sure what the problem was, but the alternate key is:JB6RJ-NV9C9-3KVWT-G2K2Y-B4CK8

Thanks, Graham. Yes, there is a legitimate, alternate key available — just one of the many weirdnesses of dealing with unfinished software.

That’s worth emphasizing again: Win8 is beta. It’s still very much a work in progress. Stuff can and most likely will break. Other stuff might work fine on one system but fail on another.

It’s frustrating that you can do everything right setting up the software, yet still end up dead in the water due to some odd little bug. That’s simply the nature of working with beta software.

Graham’s alternate key might help those who need it. Most of the problems I’ve heard about fall into one of three categories:

• VirtualBox and virtual machine problems. VirtualBox’s online documentation can help with many issues. VirtualBox VM setup is specifically covered in Chapter 3. Also, the virtual machine must support Win8’s minimum requirements, as explained in a Microsoft FAQ.
• Alternate installation media and methods. Due to space limitations, I didn’t cover installation permutations such as installing from DVD or flash drive, 64-bit software, unusual hardware, and so on. Different methods can yield different results — your mileage might vary, as they say.
• Undocumented Win8 beta bugs. If you do everything right and the Consumer Preview still won’t run on your system, don’t beat your brains out over it — it’s probably just one or more of the hidden bugs always found in prerelease products. One hopes the worst of these will be fixed in the Win8 Release Candidate (due later this spring) or the shipping version, predicted to appear this coming fall or winter.

Create system backup images when you want them

Gordon Rutzen wants to know how to run system-backup images on demand.

• “I just received a new computer with Windows 7, and I plan to follow your suggestions in the May 12, 2011, article, ‘Build a complete Windows 7 safety net.’ You mention the ability to create a system image when Win7’s backup tool is run the first time. Is the procedure the same to create a system image in the future?”

Actually, it’s even easier, Gordon. The first time you run a backup, there are setup and configuration steps. Subsequent runs don’t need that.

After that initial setup, whenever you want to make a system image on your Win7 system, just enter backup into the Start menu’s Search programs and files box and press Enter. After the backup applet opens, click the Create a system image link in the left-hand pane and follow the instructions.

That’s all it takes!

Protect your computer: sandbox apps and files

By Lincoln Spector

Every time you launch a new program, visit a website, or open a suspicious e-mail, something terrible could happen — even with honest software.

Even legitimate and malware-free software can insert itself where you don’t want it, dumping hundreds of entries into the Windows Registry — and malicious software will do much worse. Sandboxing can reduce your risk.

Isolating applications and files within Windows

A sandbox is an enclosed, controlled area of Windows in which a program can play without hurting anything outside the enclosure. Typically, a program you install inside a sandbox exists only there. It may proceed as if it were putting a file into a particular folder or changing the Registry, but those changes don’t exist outside the box.

You don’t have to confine your use of a sandbox to new, suspicious programs. You might reasonably trust your browser and your e-mail client but still find it prudent to run them in a sandbox occasionally. After all, you certainly can’t trust everything that comes through them.

Some antivirus programs, including Avast Antivirus and Comodo Internet Security, come with sandbox capabilities. But these features — especially in the free programs — are usually limited. For instance, the free version of Avast can automatically run new, untrusted programs in a sandbox, but you can’t run your existing browser or any other trusted program in one. I don’t recommend that you switch AV programs just to get an AV program’s sandboxing function.

Instead, I’ll tell you about the two best ways to sandbox programs. Neither of them completely passes the free-and-easy test. One costs money; the other takes time to set up.

Sandboxie: The best all-around sandbox tool

If you’re really serious about running programs in a safe environment, try Ronen Tzur’s Sandboxie (info). Designed solely for this purpose, it lets you create and run multiple sandboxes, launch any program within a sandbox, and control what happens to the files downloaded, saved, or created within a sandbox.

When you load Sandboxie, it shows up as an icon in the Windows notification area (the area on the Windows desktop formerly known as the systray). By default, Sandboxie loads every time you boot, but you can disable autoloading in the app’s configuration menu.

Right-clicking the Sandboxie icon displays submenus for each sandbox, including options for loading various programs such as a browser or e-mail reader (as shown in Figure 1). You can also right-click a file in Windows Explorer or a shortcut on the Start Menu and launch the file in a sandbox.

Figure 1. Right-clicking the Sandboxie icon opens various options for each sandbox.

How can you tell whether a program is running in a sandbox? Move the mouse pointer to the program’s title bar: you’ll see a yellow frame appear around the app’s window. (You’ll also see “[#]” marks on either side of the title name.) You can change the frame color and assign different colors to different boxes for easy identification.

Double-click Sandboxie’s notification-area icon to launch its control window. Here you can view what’s running inside sandboxes, manage files, and configure settings for specific sandboxes (see Figure 2) or for the entire Sandboxie system.

Figure 2. Sandboxie’s central control box

Sandboxie protects your Windows installation through special handling of file and registry changes. For example, use a sandboxed program to open a file residing outside the sandbox (on your real system). Next, save the file using Save As; Sandboxie checks whether you want to save it to the selected location on the hard drive (say, My Documents) or to a Sandboxie-protected area. (Sandboxed programs see protected files in the locations they were supposedly saved to — for example, My Documents.) However, if you try to save the file to locations such as C:Windows, Sandboxie won’t ask; it automatically saves to a protected location.

You can always recover a file, moving it from the protected space to the real location. When you delete a sandbox, you lose all unrecovered files.

Sandboxie handles the Windows Registry in a similar fashion. Registry changes made within the Sandbox are limited to the Sandbox. Put another way, programs within the sandbox see a virtual Registry that’s a mix of the real system Registry and any changes made within the sandbox.

Sandboxie isn’t free. There’s a free trial version, with upgrade nags after 30 days. Some features aren’t available until you get the license, but they’re minor. For instance, you won’t be able to run the same program in two separate sandboxes until you pay for the real deal.

A one-year personal license currently costs approximately U.S. $18 (based on a price of €13). A lifetime personal license runs about $40. If you run a lot of questionable software or sometimes have to visit websites that make you nervous, Sandboxie’s secure environment is well worth the price.

A virtual machine makes the ultimate sandbox

Sandboxie can’t protect you from everything. An error inside a sandbox can still crash your computer. On the other hand, when a virtual machine crashes, your real computer should remain up and running. (You can even take a screen shot of the virtual machine’s Blue Screen of Death.)

A virtual machine is a computer created by software — essentially just another application running on the real computer. (I discuss virtual machines in detail in the Dec. 8, 2011, Best Practices article, “VM: Running computers inside computers.”)

So why not simply create a Windows VM inside Windows and use that as a sandbox? Licensing! You have to install Windows from scratch inside the virtual machine, and Microsoft considers that a new Windows installation. To be perfectly legal, you’d have to own another copy of Windows.

If only there were a way to copy your current Windows installation and turn it into a virtual machine that you could run inside your current Windows installation.

Read on.

Converting your current Windows into a VM

Although it’s tricky, I found a way to convert my existing Windows installation into a virtual machine. I don’t guarantee that it works for everyone, but it works for me.

You’ll need two programs, both free and both from the same company. To create the virtual machine, download and install VMware vCenter Converter (info). To run it, you’ll need a program I recommended in the earlier article, VMware Player (info).

One major catch: This VM setup takes up a lot of hard-drive space — almost equal to the amount of space you’re already using. Unless your hard drive is less than half full and you don’t mind using up most of the other half, you’re not going to find this strategy viable. Here are two workarounds:

• Plug in an external hard drive and tell Converter to create the VM there. The downside is that loading the VM will be slow every time.
• You can plug in an external hard drive and move the bulk of your data files — especially large libraries such as videos, music, and photos — off your regular drive. That way, the contents of your system hard drive will be much smaller when you make the VM — and thus make the VM smaller as well. After you’ve created the VM, you can move everything back again. It’s time-consuming, but it gives you a relatively small and manageable VM.

To make a virtual copy of your real Windows installation, load VMware vCenter Converter Standalone. After it’s up, do the following:

• Step 1. Click the Convert machine button in the upper-left corner, shown in Figure 3.

  
  Figure 3. Start by clicking Convert machine.

• Step 2. For the source type, select Powered-on machine (see Figure 4).

  
  Figure 4. Select source system.

• Step 3. Check This local machine and click Next.
• Step 4. For the destination type, select VMware Workstation or other VMware Virtual Machine, shown in Figure 5.

  
  Figure 5. Select the desired VMware product.

• Step 5. For the VMware product, pick VMware Player 4.0.x, also shown in Figure 5.
• Step 6. Give the VM a name and tell the program where to save it; click Next.
• Step 7. Change settings as you wish. You’ll probably want to reduce the amount of memory, as you can see in Figure 6. Click Next.

  
  Figure 6. In the setting dialog box, you can adjust the amount of memory used.

• Step 8. Click Finish and take a very long break. This conversion can take an hour or more.

When you’re finished, assuming you’ve installed VMware Player, all you need do is go to the location where you saved the virtual machine and double-click the .vmx file. The first time the VM boots, it loads and installs some drivers and then reboots. That shouldn’t take very long.

You’ve now got the safest sandbox — if not as convenient as Sandboxie’s.

Whether you go with a simple sandbox or a virtual machine, the added layer of protection allows you to explore programs and websites that you might otherwise find too risky. Sometimes, it’s best to think inside the box.

Parental controls for kids — and adults

By Michael Lasky

There are many good reasons to limit how kids use a PC and where they go on the Internet — and sometimes good reasons to control where adults go, too. Malware, child predators, financial scams, and more are all threats to take seriously.

Windows 7’s Parental Controls is a good start, but for the best protection you need to go beyond what Win7 offers.

A well thought-out system for managing PC use

Oh, the irony. To protect his two sons, my neighbor Tom tried to set up parental controls on his Windows 7 PC. But his 11-year-old son had to show him how to do it. Although it’s too late for Tom, here’s a guide to setting up user accounts and parental controls in Windows 7 — plus an app that keeps kids safe online.

Win7’s parental controls are far from heavy-handed. They offer multiple options for limiting PC use without venturing into what some might consider Big Brother monitoring (or spying, from a kid’s point of view). You can use the controls to set computer-use time limits, block access to specific programs, and control the use of games — by title, content, or ESRB rating. (The Entertainment Software Rating Board creates age-level ratings based on games’ thematic and specific content.)

Figure 1. To enable Parental Controls, you must set up one or more standard users.

Whether your kids have their own computer or have their own accounts on a shared family PC, there are two requirements for applying Parental Controls: the PC must have at least one standard-user (not administrative-level) account, and the system’s admin account(s) must be password-protected. (Parental controls can be applied only to standard-user accounts; they’re set using an admin account.) Also, make sure your kids can’t easily guess the admin password.

A side note: Win7’s parental controls can be used on any standard user account — adults’ accounts included. For example, use the controls if you want to restrict when a PC can be used by someone other than yourself — say, to prevent interference with automatic backups or to limit the Guest account.

The basics of setting up Parental Controls

Creating user accounts and setting restrictions is really quite easy (sorry, Tom). Start in the Control Panel’s User Accounts and Family Settings heading. If you don’t want to click Start/Control Panel/User Accounts/blah, blah, blah, just type “use” into the Start menu’s search bar. Look for User Accounts — it should be near the top of the list. Click it and you’re there.

Now click Add or remove user accounts. Click the Create user account link below the existing user icons. Fill in the new account name and make sure the Standard user button is selected. If you create more than one standard user, click each new user’s icon picture and create a simple password. (Standard users can change their passwords later.)

Once you have a standard account for each user, it’s time to place parental controls on each of them. From the User Accounts and Family Safety page, click Parental Controls, select the user’s icon, and click the On, enforce current settings button (see Figure 2).

Figure 2. Windows 7’s main parental controls dialog box

To establish times when a user can’t sign in to the system, click the Time Limits Off link to turn it on. A 24-hour time grid will appear (shown in Figure 3). Click the box for every hour you want blocked, then click OK.

Figure 3. Computer usage times and dates box

Game play is a difficult topic for most parents. Let’s face it, many commercial games are extremely violent or have either overt or suggestive sexual material that’s not appropriate for underaged children. To block installed games, click the Game Ratings Off link, which opens the games control window. Assuming you allow your child to play some games, click the Yes button. You can then block ESRB-rated games above an age level (as shown in Figure 4) as well as specific games installed on the PC. (For more on ESRB ratings, see its “ESRB Game Ratings” page.)

Figure 4. Win7 ESRB parental controls

Windows displays the ESRB ratings table with descriptions of the criteria that define each level. Alas, many Windows games are not rated by the ESRB — particularly shareware, freeware, and the games preinstalled with the OS such as Hearts, Solitaire, and Minesweeper. You can still control access to any of these by clicking Block or Allow specific games in the Game Control window. A second games-control window will appear (see Figure 5).

Figure 5. Use this dialog box to control specific games.

Windows also lets you control application use. Click Allow and block specific programs and, in the Application Restrictions window, click the radio button beside (sign-on name) can only use the programs I allow. Windows then loads a list of what seems like every conceivable program (see Figure 6). Check the programs that are allowed. This will prove to be a tedious exercise, as there are literally hundreds of programs listed. You are better off clicking the Select all button and then going through the list and unchecking those you will allow.

Figure 6. Win7 lets you select all the apps a child may use.

Managing where kids go on the Internet

Windows 7’s parental controls are fine for managing PC use. But they don’t limit what kids view on the Internet. For that, you need third-party Web filters that screen out objectionable sites. You’ll find this topic nicely covered in Susan Bradley’s Top Story, “Web filtering keeps you a little safer.” But here’s a bit more information you can use.

One highly regarded application is InternetSafety.com’s Safe Eyes (info). The Safe Eyes package blocks Web content by category and by specific site. It also offers tools for setting time limits on Internet usage and for monitoring and blocking instant messaging, e-mail, YouTube videos, and social networking.

Once it’s installed on a PC, you can access the U.S. $40 program (under $32 at Amazon.com) via the Additional Controls menu in Win7’s main Parental Controls panel. (The Additional Controls link appears only after SafeEyes, or similar software, has been installed.)

Credentials Manager saves user names to the net

For quick Internet sign-ins, Microsoft lets you store user-account names and passwords on a network via the Windows Credential Manager (also found on Win7’s User Accounts page). By storing your credentials, Windows can automatically sign you in to websites or other computers. Credentials are saved in special folders (vaults) on your computer. Windows and programs such as Web browsers can securely share your credentials with other computers and websites. (For more on this topic, see Microsoft’s “What is Credential Manager?” page.)

That’s well and good, but so far the service appears to work only with Microsoft’s Windows Live, MSN.com, and Hotmail — after you give permission to install Windows Live ID Sign-in Assistant 7.0, which links your Windows Live ID with a Win7 user account.

Unfortunately, installing the applet also installs Windows Live Essentials 2011, which includes Movie Maker and Photo Gallery, among others. So unless you have a Windows Live account and have use for the Essentials apps, Credentials Manager is probably of limited value.