Windows OS Managed Client: How to manage iTunes control features

Parental Controls Registry Keys

Parental controls in iTunes for Windows are managed using the registry. Parental control preferences are stored under two registry keys:

On Windows XP and 32-bit Windows Vista:

• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\


• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\

 On 64-bit Windows Vista:

• HKEY_LOCAL_MACHINE\Software\Wow6432Node\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\


• HKEY_CURRENT_USER\Software\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\


• [SID] is the string representation of a user account's security identifier. Typically, it looks like:
  S-1-5-21-1715567821-1202687629-839522115-1003

Since every account has a different SID, iTunes can store parental control preferences for every user uniquely in HKEY_LOCAL_MACHINE.

If you want to specify parental control preferences that will be inherited by new user accounts, these can be created under the following keys:

On Windows XP and 32-bit Windows Vista:

• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\

On 64-bit Windows Vista:

• HKEY_LOCAL_MACHINE\Software\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default\

In iTunes 8.0.2 and later, values under these keys will be used if the user-specific [SID] values don't exist.

Parental control preferences are stored in five registry values under each of the keys mentioned above. When parental controls are locked, iTunes uses these values:

• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminFlags
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminMoviesLimit
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminTVShowsLimit
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminRatingSystemID
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminGamesLimit
  

In iTunes 8.0.2 and later, if these user-specific [SID] values don't exist, iTunes uses these values:

• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
  
• HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit
  

When parental controls are unlocked, iTunes uses these values:

• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserFlags
• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserMoviesLimit
• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserTVShowsLimit
• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserRatingSystemID
• HKEY_CURRENT_USER\Software\Apple Computer, Inc.\iTunes\Parental Controls\UserGamesLimit

Values for UserFlags and AdminFlags

The value stored in UserFlags and AdminFlags is a bitmask of flags, defined as follows:

kParentalFlags_Locked = 0x00000001
kParentalFlags_DisablePodcasts = 0x00000002
kParentalFlags_DisableMusicStore = 0x00000004
kParentalFlags_DisableSharing = 0x00000008
kParentalFlags_DisableExplicitContent = 0x00000010
kParentalFlags_DisableRadio = 0x00000020
kParentalFlags_RestrictMovieContent = 0x00000040
kParentalFlags_RestrictTVShowContent = 0x00000080
kParentalFlags_DisableCheckForUpdates = 0x00000100
kParentalFlags_RestrictGames = 0x00000200
kParentalFlags_DisableMiniStore = 0x00000400
kParentalFlags_DisableAutomaticDeviceSync = 0x00000800
kParentalFlags_DisableGetAlbumArtwork = 0x00001000
kParentalFlags_DisablePlugins = 0x00002000
kParentalFlags_DisableOpenStream = 0x00004000
kParentalFlags_DisableAppleTV = 0x00008000
kParentalFlags_DisableDeviceRegistration = 0x00010000
kParentalFlags_DisableDiagnostics = 0x00020000
kParentalFlags_AllowITunesUAccess = (1<<18) // (0x00040000) added in iTunes 8.1

Values for UserMoviesLimit, UserTVShowsLimit, AdminMoviesLimit, and AdminTVShowsLimit

These values are not publicly documented. Typically, system administrators will only be concerned with the parental control preferences specified by UserFlags and AdminFlags.

UserFlags, UserMoviesLimit, and UserTVShowsLimit

These values represent unlocked parental controls. Since they live under the HKEY_CURRENT_USER key, they can always be written to by the current user without elevating privileges. In other words, you should not use these registry values if you wish to prevent a limited user from modifying parental controls.

The UserFlags, UserMoviesLimit, UserTVShowsLimit, UserRatingSystemID and UserGamesLimit values are only respected by iTunes if there is no AdminFlags value in HKEY_LOCAL_MACHINE, or if the kParentalFlags_Locked bit in the AdminFlags value is 0, indicating that parental controls are unlocked.

AdminFlags, AdminMoviesLimit, and AdminTVShowsLimit

These values represent locked parental controls. Since they live under the HKEY_LOCAL_MACHINE key, they cannot be modified by a limited user. When iTunes detects that an AdminFlags value for the current user exists, and it indicates that controls are locked, it will use that value and ignore any UserXXX values under HKEY_CURRENT_USER. Note that the AdminXXX values may not reflect the current parental controls settings if the controls are unlocked, since only the UserXXX values are maintained in this case. However, the locked bit in AdminFlags should always be correct.

Preconfiguring Parental Controls

In order to preconfigure parental controls, you must set the three registry values in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\ for each user account. One way to do this is to use iTunes to set up and lock the parental control preferences for a user, then replicate the values for that user under the registry keys for other user account security identifiers (SIDs) (Assuming you don't need to set any of the flags listed below that can't be controlled from the iTunes user interface). Alternately, with the information above about the values for AdminFlags, you can define your own parental control values without help from iTunes.

If you would like to preconfigure parental controls for user accounts that you will create in the future and user accounts that have not yet been used, you can specify the following values for Windows XP and Vista 32-bit in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\ (in iTunes 8.0.2 and later):

HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

And for Windows Vista 64-bit in HKEY_LOCAL_MACHINE\Wow6432Node\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\ (in iTunes 8.0.2 and later):

HKEY_LOCAL_MACHINE\ Wow6432Node\Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
HKEY_LOCAL_MACHINE\ Wow6432Node\ Software\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

Note: For a given user account, the keys under HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\Parental Controls\Default will be used if the account-specific keys in HKEY_LOCAL_MACHINE\Software\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\ do not exist.

In general, you will want to make sure that the kParentalFlags_Locked is set in AdminFlags to prevent the parental controls from being modified by a limited user.

Note that there is no user interface support in iTunes for setting the following flags, and these flags are only respected in AdminFlags when kParentalFlags_Locked is set. These flags are always ignored in UserFlags, they must be set in AdminFlags. As noted above, if AdminFlags is not locked, iTunes will ignore them in favor of UserFlags.

kParentalFlags_DisableCheckForUpdates = 0x00000100
kParentalFlags_DisableMiniStore = 0x00000400
kParentalFlags_DisableAutomaticDeviceSync = 0x00000800
kParentalFlags_DisableGetAlbumArtwork = 0x00001000
kParentalFlags_DisablePlugins = 0x00002000
kParentalFlags_DisableOpenStream = 0x00004000
kParentalFlags_DisableAppleTV = 0x00008000
kParentalFlags_DisableDeviceRegistration = 0x00010000
kParentalFlags_DisableDiagnostics = 0x00020000

For example, if you want to disable the MiniStore, you should set the AdminFlags registry value to 0x00000401 (i.e. kParentalFlags_Locked | kParentalFlags_DisableMiniStore).