Languages

Windows OS Managed Client: How to manage iTunes control features

This article explains how to manage iTunes control features.

This article applies only to Microsoft Windows-compatible computers. For documentation on administrative management of iTunes Control Features in OS X, please read article HT2653 and HT3490. For information regarding use of the iTunes Parental controls via iTunes preferences, please read article HT1904.

iTunes offers parental, enterprise, and education controls which give system administrators the ability to set content restrictions. The following information is for customers who want to pre-configure parental and/or other controls in iTunes for Microsoft Windows. This information only applies to iTunes 7.1 or later.


Important: The following steps involve making changes to the Windows registry using the Registry Editor (Regedit). Even if you are very comfortable editing the registry, you should make a backup of the registry prior to editing it. Making mistakes in Regedit can cause strange behaviors or prevent Windows from starting. The changes may cause the software that installed the entries to work incorrectly until you restore the entries.

How to back up and restore the registry in Windows
Windows registry information for advanced users

Parental Controls Registry Keys

Parental controls in iTunes for Windows are managed using the registry. Parental control preferences are stored under two registry keys

On Windows XP and 32-bit Windows Vista, Windows 7 and Windows 8

  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\

  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\

 On 64-bit Windows Vista, Windows 7 and Windows 8

  • HKEY_LOCAL_MACHINE\Software\Wow6432Node\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\

  • HKEY_CURRENT_USER\Software\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\

  • [SID] is the string representation of a user account's security identifier. Typically, it looks like:
    S-1-5-21-1715567821-1202687629-839522115-1003

Since every account has a different SID, iTunes can store parental control preferences for every user uniquely in HKEY_LOCAL_MACHINE.

If you want to specify parental control preferences that will be inherited by new user accounts, these can be created under the following keys:

On Windows XP and 32-bit Windows Vista, Windows 7 and Windows 8

  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\

 On 64-bit Windows Vista, Windows 7 and Windows 8

  • HKEY_LOCAL_MACHINE\Software\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default\

In iTunes 8.0.2 and later, values under these keys will be used if the user-specific [SID] values don't exist.

Parental control preferences are stored in five registry values under each of the keys mentioned above. When parental controls are locked, iTunes uses these values:

  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminFlags
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminGamesLimit


In iTunes 8.0.2 and later, if these user-specific [SID] values don't exist, iTunes uses these values:

  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

When parental controls are unlocked, iTunes uses these values:

  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserFlags
  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserMoviesLimit
  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserTVShowsLimit
  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserRatingSystemID
  • HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserGamesLimit

Values for UserFlags and AdminFlags

The value stored in UserFlags and AdminFlags is a bitmask of flags, defined as follows:

kParentalFlags_Locked 0x00000001 1  
kParentalFlags_DisablePodcasts 0x00000002 2  
kParentalFlags_DisableMusicStore 0x00000004 4  
kParentalFlags_DisableSharing 0x00000008 8  
kParentalFlags_DisableExplicitContent 0x00000010 16  
kParentalFlags_DisableRadio 0x00000020 32  
kParentalFlags_RestrictMovieContent 0x00000040 64  
kParentalFlags_RestrictTVShowContent 0x00000080 128  
kParentalFlags_DisableCheckForUpdates 0x00000100 256  
kParentalFlags_RestrictGames 0x00000200 512  
kParentalFlags_DisableAutomaticDeviceSync 0x00000800 2048  
kParentalFlags_DisableGetAlbumArtwork 0x00001000 4096  
kParentalFlags_DisablePlugins 0x00002000 8192  
kParentalFlags_DisableOpenStream 0x00004000 16384  
kParentalFlags_DisableAppleTV 0x00008000 32768  
kParentalFlags_DisableDeviceRegistration 0x00010000 65536  
kParentalFlags_DisableDiagnostics 0x00020000 131072  
kParentalFlags_AllowITunesUAccess 0x00040000 262144 added in iTunes 8.1
kParentalFlags_RequireEncryptedBackups 0x00080000 524288 added in iTunes 8.2
kParentalFlags_DisableHomeSharing 0x00100000 1048576 added in iTunes 10
kParentalFlags_DisableCheckForAppUpdates 0x00200000 2097152 added in iTunes 10
kParentalFlags_DisableCheckForDeviceUpdates 0x00400000 4194304 added in iTunes 10
kParentlFlags_DisableFirstRunWelcomeWindow 0x01000000 16777216

added in iTunes 10.2

kParentalFlags_DisableDeviceFileSharing 0x02000000 33554432

added in iTunes 10.4

kParentalFlags_DisableExplicitBooks 0x40000000 67108864

added in iTunes 11.0

 

Values for UserMoviesLimit, UserTVShowsLimit, AdminMoviesLimit, and AdminTVShowsLimit

These values are not publicly documented. Typically, system administrators will only be concerned with the parental control preferences specified by UserFlags and AdminFlags.

UserFlags, UserMoviesLimit, and UserTVShowsLimit

These values represent unlocked parental controls. Since they live under the HKEY_CURRENT_USER key, they can always be written to by the current user without elevating privileges. In other words, you should not use these registry values if you wish to prevent a limited user from modifying parental controls.

The UserFlags, UserMoviesLimit, UserTVShowsLimit, UserRatingSystemID and UserGamesLimit values are only respected by iTunes if there is no AdminFlags value in HKEY_LOCAL_MACHINE, or if the kParentalFlags_Locked bit in the AdminFlags value is 0, indicating that parental controls are unlocked.

AdminFlags, AdminMoviesLimit, and AdminTVShowsLimit

These values represent locked parental controls. Since they live under the HKEY_LOCAL_MACHINE key, they cannot be modified by a limited user. When iTunes detects that an AdminFlags value for the current user exists, and it indicates that controls are locked, it will use that value and ignore any UserXXX values under HKEY_CURRENT_USER. Note that the AdminXXX values may not reflect the current parental controls settings if the controls are unlocked, since only the UserXXX values are maintained in this case. However, the locked bit in AdminFlags should always be correct.

Preconfiguring Parental Controls

In order to preconfigure parental controls, you must set the three registry values in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\ for each user account. One way to do this is to use iTunes to set up and lock the parental control preferences for a user, then replicate the values for that user under the registry keys for other user account security identifiers (SIDs) (Assuming you don't need to set any of the flags listed below that can't be controlled from the iTunes user interface). Alternately, with the information above about the values for AdminFlags, you can define your own parental control values without help from iTunes.

If you would like to preconfigure parental controls for user accounts that you will create in the future and user accounts that have not yet been used, you can specify the following values for Windows XP and Windows Vista, Windows 7 and Windows 8 32-bit in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\ (in iTunes 8.0.2 and later):

HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

And for Windows Vista, Windows 7 and Windows 8 64-bit in HKEY_LOCAL_MACHINE\Wow6432Node\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\ (in iTunes 8.0.2 and later):

HKEY_LOCAL_MACHINE\ Wow6432Node\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

Note: For a given user account, the keys under HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\Parental Controls\Default will be used if the account-specific keys in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\ do not exist.

In general, you will want to make sure that the kParentalFlags_Locked is set in AdminFlags to prevent the parental controls from being modified by a limited user.

Note that there is no user interface support in iTunes for setting the following flags, and these flags are only respected in AdminFlags when kParentalFlags_Locked is set. These flags are always ignored in UserFlags, they must be set in AdminFlags. As noted above, if AdminFlags is not locked, iTunes will ignore them in favor of UserFlags.

kParentalFlags_DisableCheckForUpdates 0x00000100 256
kParentalFlags_DisableAutomaticDeviceSync 0x00000800 2048
kParentalFlags_DisableGetAlbumArtwork 0x00001000 4096
kParentalFlags_DisablePlugins 0x00002000 8192
kParentalFlags_DisableOpenStream 0x00004000 16384
kParentalFlags_DisableAppleTV 0x00008000 32768
kParentalFlags_DisableDeviceRegistration 0x00010000 65536
kParentalFlags_DisableDiagnostics 0x00020000 131072
kParentalFlags_RequireEncryptedBackups 0x00080000 524288
kParentalFlags_DisableHomeSharing 0x00100000 1048576
kParentalFlags_DisableCheckForAppUpdates 0x00200000 2097152
kParentalFlags_DisableCheckForDeviceUpdates 0x00400000 4194304


For example, if you want to disable the Check for Device Updates, you should set the AdminFlags registry value to 0x40000000 (i.e. kParentalFlags_Locked | kParentalFlags_DisableCheckForAppUpdates).

Important: Mention of third-party websites and products is for informational purposes only and constitutes neither an endorsement nor a recommendation. Apple assumes no responsibility with regard to the selection, performance or use of information or products found at third-party websites. Apple provides this only as a convenience to our users. Apple has not tested the information found on these sites and makes no representations regarding its accuracy or reliability. There are risks inherent in the use of any information or products found on the Internet, and Apple assumes no responsibility in this regard. Please understand that a third-party site is independent from Apple and that Apple has no control over the content on that website. Please contact the vendor for additional information.
Last Modified: Jan 17, 2014
Helpful?
Yes
No
  • Last Modified: Jan 17, 2014
  • Article: HT2102
  • Views:

    null

Additional Product Support Information

Start a Discussion
in Apple Support Communities
See all questions on this article See all questions I have asked