# Family safety and child accounts: what works offline

> How child accounts, screen time and content limits are enforced, which parts need a connection, and where the limits stop.

**Tested on**

- Build: 26300.9457
- Edition: Pro (26H2)
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

Family safety is a **cloud service with a local agent**, not a local Windows feature. That single fact explains every surprise:

- **Screen time and app/game limits** are evaluated against the Microsoft family group online; with no connection, enforcement is inconsistent.
- **Content filtering** applies to Microsoft Edge and the Microsoft Store — not to every browser or every app.
- **Activity reports** need the account to be a child account in a family group.

If the machine must be restricted offline, family safety is the wrong tool: use a **standard user account** plus local policy.

## Setting it up

1. The child needs a **Microsoft account** (not a local account).
2. An adult adds it to a **family group** at account.microsoft.com/family.
3. On the PC: **Settings → Accounts → Family & other users** → add the child account.
4. Configure limits online — the local UI mostly reflects them.

```powershell
# who is on this machine and what type
Get-LocalUser | Select-Object Name,Enabled,PrincipalSource,Description
Get-CimInstance Win32_UserAccount -Filter "LocalAccount=True" | Select-Object Name,SID,Disabled
```

A child account shows `PrincipalSource : MicrosoftAccount`. A local account is not a child account no matter what you name it.

## What is actually enforced where

| Control | Enforced by | Works offline? |
|---|---|---|
| Screen time (hours) | cloud + local agent | partly — clock-based, syncs late |
| App/game limits | cloud + Store | only for Store apps |
| Content filtering | Edge + Store + Bing | no |
| Purchase approval | Store | no |
| Activity report | cloud | no |
| **Standard user (no admin)** | local Windows | **yes** |

The last row is the only one that is fully local, and it is the one that matters most: a standard user cannot install drivers or change system settings.

## The limits people hit

- **Steam, Epic, standalone installers** are not Store apps and are not covered by app limits.
- **A second browser** bypasses content filtering entirely.
- **A child with administrator rights** can remove the family link — do not make the child account an admin.
- **Time zones**: screen time follows the account's time zone, which can shift limits unexpectedly.

> **Caution: Family safety is not parental-control software**
>
> It cannot see what a game displays, block a VPN, or stop a determined teenager with a USB stick. It is a friction layer plus reporting, and it should be presented as such — not as a guarantee.

## When you need real restriction

| Requirement | Better approach |
|---|---|
| Block installations | standard user + AppLocker/WDAC policy |
| Block sites regardless of browser | DNS filtering at the router |
| Fixed usage window | kiosk / assigned access, or router schedule |
| Audit what ran | event logs / third-party tooling |

## Related

- [Local account or Microsoft account](https://winbook.fyi/en/windows/account/local-vs-msa/)
- [A corrupt profile](https://winbook.fyi/en/windows/account/profile-corruption/)
- [Windows Sandbox](https://winbook.fyi/en/windows/customise/sandbox/)

## Lab boundary

E1. Family group behaviour is documented by Microsoft and depends on the cloud service. The lab VMs have no family group, so no enforcement was observed.

## Sources

- [Microsoft Learn — Accounts CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/accounts-csp)
- [Microsoft Learn — Privacy policy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-privacy)
- [Microsoft Learn — Windows 11 overview](https://learn.microsoft.com/en-us/windows/whats-new/windows-11-overview)

---

Source: https://winbook.fyi/en/windows/account/family-safety/