Windows parental controls have improved significantly with Microsoft Family Safety, but they have one critical prerequisite that catches most parents off guard: they only work when your child uses a Microsoft account. If your child logs into Windows with a local account — which is common, especially on older setups — every parental control in this guide is completely bypassed.
I'm a cybersecurity professional and father of three. This guide covers the full setup in the right order, the browser gap (Edge-only filtering is a real problem), and how to use DNS filtering at the router to cover what Microsoft can't.
This guide primarily covers Windows 11. Most settings apply to Windows 10 as well through the same Microsoft Family Safety interface.
Before you start
Have these ready:
- The child's Windows PC
- Your Microsoft parent account (the one that owns the family group)
- The child's Microsoft login if they already have one
- 15–20 minutes to verify account type and first limits
Optional: DNS filtering (home-network website blocking) on your router for coverage in every browser — covered in Section 8.
1. The Account Requirement (Read This First)
Before touching any parental control settings, you need to understand how Windows account types work — because getting this wrong means your child operates with zero restrictions.
Microsoft Family Safety does not work on local accounts
A local account is a Windows account that exists only on the computer, with no connection to a Microsoft account online. Microsoft's parental controls — Family Safety, screen time limits, content filters, spending controls — require a Microsoft account (an @outlook.com, @hotmail.com, @live.com, or custom email linked to Microsoft).
If your child's Windows account is local, they have no parental controls whatsoever, regardless of what you configure. Check now: go to Settings → Accounts → Your info on their account. If it says "Local account," you need to fix this before anything else.
Convert a local account to a Microsoft account
On the child's Windows account, go to Settings → Accounts → Your info → Sign in with a Microsoft account instead. Sign in with their existing Microsoft account, or create a new one during this process. This converts the local account to a Microsoft account while keeping all their files and settings intact.
Make sure your child's account is a standard user, not an administrator
While you're in account settings, verify your child's account type is Standard User, not Administrator. Administrators can install software, change system settings, and remove restrictions. On the child's account, go to Settings → Accounts → Family & other users → [Child's account] → Change account type → Standard User.
2. Setting Up Microsoft Family Safety
Add your child to your Microsoft Family group
On your own device (PC or phone), go to account.microsoft.com/family and sign in with your Microsoft account. Click Add a family member → Member → Child and enter your child's Microsoft account email. They'll receive an invitation — have them accept it from their account. Once accepted, their account is linked to your family group and subject to Family Safety controls.
Download the Microsoft Family Safety app on your phone
The Microsoft Family Safety app (free, iOS and Android) lets you manage all settings, view activity reports, and adjust screen time limits remotely from your phone. This is much more convenient than logging into the website every time. Download it and sign in with your Microsoft account.
Set a strong password on your Windows admin account
Your Windows account must remain an Administrator to manage the computer. Make sure it has a strong password your child doesn't know — if they can log into your account, they can change all the family settings and install whatever they want. Use a password manager to generate a strong one, and consider Windows Hello (fingerprint or face unlock) so you don't have to type it every time.
3. Screen Time Limits & App Limits
Set daily screen time limits for Windows
In the Family Safety app or at account.microsoft.com/family, select your child and go to Screen time. Enable screen time limits for their Windows device. You can set a total daily limit and configure specific hours when the PC is accessible — for example, available 3–9 PM on school days and 9 AM–10 PM on weekends.
When the time limit is reached, Windows locks the account and displays a message. Your child can send a request for more time, which you approve or deny from your phone.
Set per-app time limits
Under the child's Screen time settings, you can also set limits for individual apps and games installed on Windows. For example: 1 hour of Minecraft per day, 30 minutes of Roblox. Per-app limits are separate from the device-wide limit — an app limit can run out while device time remains, or vice versa.
Managing controls across every device?
CyberDaddy monitors parental controls across Windows, Android, iPhone, gaming consoles, and your home network — one dashboard instead of juggling Microsoft, Google, and Apple family apps simultaneously.
4. Content Filters & SafeSearch
Enable web filtering in Microsoft Edge
In Family Safety, go to your child's settings and select Content filters → Web browsing. Enable "Filter inappropriate websites and searches." This activates Microsoft's SafeSearch enforcement and blocks access to adult content categories in Microsoft Edge.
You can also add specific sites to an Always Blocked or Always Allowed list. For young children (under 10), consider enabling "Only use allowed websites" for maximum restriction.
Content filtering applies to Microsoft Edge — not Chrome or Firefox
This is the biggest gap in Microsoft's parental control system. Content filters and SafeSearch enforcement work in Microsoft Edge only. If Chrome or Firefox is installed on the computer, your child can browse to any site without restriction. To address this: either remove Chrome and Firefox entirely (see Section 7 for how to prevent reinstallation), or use DNS filtering at your router as a backstop that applies to all browsers.
Block specific apps from running
In Family Safety under Content filters → Apps and games, you can block specific installed applications from running on your child's account. For example, you can block Chrome if you want them to use only Edge, or block specific games entirely regardless of time limits.
5. Spending Controls
Set a spending allowance for the Microsoft Store
In Family Safety, go to Spending → Set a limit. You can set a monthly spending limit for purchases in the Microsoft Store (apps, games, movies). Setting this to $0 means your child cannot purchase anything from the store without your approval. Alternatively, set a small monthly allowance for approved purchases.
Microsoft spending controls apply to the Microsoft Store only
Spending limits cover Microsoft Store purchases — but not in-game purchases in games downloaded from Steam, Epic Games Store, or other platforms, nor purchases made in a browser. For in-game currencies (Robux, V-Bucks), you need to manage spending within each platform separately. The safest approach: remove saved payment methods from any gaming accounts your child has access to.
6. Activity Reports
Review weekly activity reports
Microsoft Family Safety automatically emails you a weekly activity report showing which apps were used, websites visited (in Edge), and how much time was spent on the computer. You can also check any time in the Family Safety app under your child's profile. Review these regularly — patterns in usage are often more informative than individual incidents.
Enable location sharing (if applicable)
If your child uses a Windows laptop that they take to school, Family Safety can share the device's location with you (requires location services to be enabled on the device and Windows 11). Less useful than phone location since laptops stay in bags — but worth enabling for peace of mind.
7. Bypass Tricks and How to Close Them
Third-party browsers bypass Edge content filters completely
If your child installs Chrome, Firefox, Brave, or any other browser, they can browse without any content filter. Standard users cannot install software by default — but only if your child genuinely has a Standard account. Verify their account type under Settings → Accounts → Family & other users. If they can install software, they have admin rights and you need to demote the account to Standard User.
For extra certainty, use Family Safety's app blocking feature to explicitly block any browser executables other than Edge.
Any local account on the PC is completely uncontrolled
If there is any local (non-Microsoft) account on the computer — even one from an old setup — your child can log into that account and operate with full standard-user access and zero parental controls. Check all accounts on the machine under Settings → Accounts → Family & other users. Remove any local accounts that shouldn't be there.
Windows Safe Mode can bypass some restrictions
Advanced users know that booting into Windows Safe Mode loads a minimal environment where some restrictions don't apply. To prevent this: ensure your child's account doesn't have access to recovery options, and set a BIOS/UEFI password if the computer is shared. For most children this is too technical to attempt, but tech-savvy teenagers may research it.
Connecting to a phone hotspot bypasses router DNS filtering
If you rely on router-level DNS filtering (Section 8), your child can bypass it by connecting the PC to their phone's mobile hotspot instead of your home Wi-Fi. Family Safety's Edge content filter still applies regardless of network, but DNS filtering does not. Consider this when choosing your protection layers — Family Safety + DNS is better than either alone.
8. DNS Filtering — The Essential Extra Layer
Microsoft's content filters protect Edge. DNS filtering (blocking bad sites at the network “phonebook” before they load) at your router protects every browser, every app, and every device in your home — simultaneously.
Set DNS filtering on the Windows device itself
For a device-level DNS filter that works regardless of which router the laptop connects to, set DNS manually in Windows network settings. Go to Settings → Network & Internet → Wi-Fi → [Network] → DNS server assignment → Manual. Enter a filtering DNS address.
CleanBrowsing Family Filter (free)
Primary: 185.228.168.168 · Secondary: 185.228.169.168
Blocks adult content and enforces SafeSearch on all search engines across all browsers. No account required.
Better: DNS filtering at your router
Router-level DNS filtering covers every device — not just the Windows PC. One setup protects the whole household. See our full comparison: Best DNS Filtering for Families: NextDNS vs CleanBrowsing vs OpenDNS.
Standard users can change their own DNS settings
Unfortunately, changing network DNS settings in Windows doesn't require administrator access. A determined child with internet search skills can find out how to change their DNS settings and switch to an unfiltered DNS server. To prevent this, use router-level DNS filtering (which can't be bypassed from the device) rather than per-device DNS, and ensure the router admin credentials are private.
Frequently Asked Questions
Windows is one device in your home.
Your kids also use phones, tablets, and gaming consoles — each with its own parental control system. CyberDaddy gives you one dashboard to set up, verify, and monitor all of them without juggling Microsoft, Apple, and Google family apps at once.
Not ready yet? Get the free setup checklist by email: