Family safety and child accounts: what works offline

Verified 2026-10-292 min read

How child accounts, screen time and content limits are enforced, which parts need a connection, and where the limits stop.

Tested onPro (26H2) · Build 26300.9457 · x64

Build: 26300.9457
Edition: Pro (26H2)
Architecture: x64
Support: Documentation (E1)
Evidence: E1Official documentation
Verified: 2026-10-29
Page type: Task

The short answer

Family safety is a cloud service with a local agent, not a local Windows feature. That single fact explains every surprise:

Screen time and app/game limits are evaluated against the Microsoft family group online; with no connection, enforcement is inconsistent.
Content filtering applies to Microsoft Edge and the Microsoft Store — not to every browser or every app.
Activity reports need the account to be a child account in a family group.

If the machine must be restricted offline, family safety is the wrong tool: use a standard user account plus local policy.

Setting it up

The child needs a Microsoft account (not a local account).
An adult adds it to a family group at account.microsoft.com/family.
On the PC: Settings → Accounts → Family & other users → add the child account.
Configure limits online — the local UI mostly reflects them.

# who is on this machine and what type
Get-LocalUser | Select-Object Name,Enabled,PrincipalSource,Description
Get-CimInstance Win32_UserAccount -Filter "LocalAccount=True" | Select-Object Name,SID,Disabled

A child account shows PrincipalSource : MicrosoftAccount. A local account is not a child account no matter what you name it.

What is actually enforced where

Control	Enforced by	Works offline?
Screen time (hours)	cloud + local agent	partly — clock-based, syncs late
App/game limits	cloud + Store	only for Store apps
Content filtering	Edge + Store + Bing	no
Purchase approval	Store	no
Activity report	cloud	no
Standard user (no admin)	local Windows	yes

The last row is the only one that is fully local, and it is the one that matters most: a standard user cannot install drivers or change system settings.

The limits people hit

Steam, Epic, standalone installers are not Store apps and are not covered by app limits.
A second browser bypasses content filtering entirely.
A child with administrator rights can remove the family link — do not make the child account an admin.
Time zones: screen time follows the account’s time zone, which can shift limits unexpectedly.

When you need real restriction

Requirement	Better approach
Block installations	standard user + AppLocker/WDAC policy
Block sites regardless of browser	DNS filtering at the router
Fixed usage window	kiosk / assigned access, or router schedule
Audit what ran	event logs / third-party tooling

Lab boundary

E1. Family group behaviour is documented by Microsoft and depends on the cloud service. The lab VMs have no family group, so no enforcement was observed.