Manage control features in iTunes for Windows

Use the parental, enterprise and education controls in iTunes to restrict content.

This article only applies to iTunes 7.1 or later running on Windows computers.

System administrators can use parental, enterprise and education controls in iTunes for Windows to set content restrictions.

The steps in this article use Registry Editor (Regedit.exe) to make changes to the Windows registry. Even if you're experienced with using Registry Editor, back up the registry first. If you make a mistake, it can cause issues with your computer or prevent Windows from starting.

Registry keys for parental controls

Two registry keys manage parental controls for iTunes for Windows.

On Windows XP and 32-bit Windows Vista, Windows 7, Windows 8 and Windows 10

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls

On 64-bit Windows Vista, Windows 7, Windows 8 and Windows 10

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\[SID]\Parental Controls

  • HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls

Set parental control preferences

The user-specific value [SID] is a string representation of a user account's security identifier. Typically, it looks like: S-1-5-21-1715567821-1202687629-839522115-1003.

Every user account has a different user-specific value [SID]. For that reason, iTunes can store unique parental control preferences for every user uniquely in HKEY_LOCAL_MACHINE. To set parental control preferences that are inherited by new user accounts, create them under the following registry keys.

On Windows 32-bit systems

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default

On Windows 64-bit systems

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default

iTunes 8.0.2 and later versions use the values under these keys when user-specific [SID] values don't exist.

iTunes stores parental control preferences in five registry values. iTunes uses these values when parental controls are locked:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminFlags

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminMoviesLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminTVShowsLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminRatingSystemID

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminGamesLimit

iTunes 8.0.2 and later versions use these values when user-specific [SID] values don't exist:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

iTunes uses these values when parental controls are unlocked:

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserFlags

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserMoviesLimit

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserTVShowsLimit

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserRatingSystemID

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserGamesLimit

Values for UserFlags and AdminFlags

UserFlags or AdminFlags name

Hexidecimal value

(only when manually editing the client registry value)

Decimal value

(only when deploying registry value via Group Policy)

Notes

kParentalFlags_Locked

0x00000001

1

kParentalFlags_DisablePodcasts

0x00000002

2

kParentalFlags_DisableMusicStore

0x00000004

4

kParentalFlags_DisableSharing

0x00000008

8

kParentalFlags_DisableExplicitContent

0x00000010

16

kParentalFlags_DisableRadio

0x00000020

32

This flag only disables internet radio. It doesn't disable Apple Music radio stations.

kParentalFlags_RestrictMovieContent

0x00000040

64

kParentalFlags_RestrictTVShowContent

0x00000080

128

kParentalFlags_DisableCheckForUpdates

0x00000100

256

kParentalFlags_RestrictGames

0x00000200

512

kParentalFlags_DisableAutomaticDeviceSync

0x00000800

2048

kParentalFlags_DisableGetAlbumArtwork

0x00001000

4096

kParentalFlags_DisablePlugins

0x00002000

8192

kParentalFlags_DisableOpenStream

0x00004000

16384

kParentalFlags_DisableAppleTV

0x00008000

32768

kParentalFlags_DisableDeviceRegistration

0x00010000

65536

kParentalFlags_DisableDiagnostics

0x00020000

131072

kParentalFlags_AllowITunesUAccess

0x00040000

262144

added in iTunes 8.1

kParentalFlags_RequireEncryptedBackups

0x00080000

524288

added in iTunes 8.2

kParentalFlags_DisableHomeSharing

0x00100000

1048576

added in iTunes 10

kParentalFlags_DisableCheckForAppUpdates

0x00200000

2097152

added in iTunes 10

kParentalFlags_DisableCheckForDeviceUpdates

0x00400000

4194304

added in iTunes 10

kParentlFlags_DisableFirstRunWelcomeWindow

0x01000000

16777216

added in iTunes 10.2

kParentalFlags_DisableDeviceFileSharing

0x02000000

33554432

added in iTunes 10.4

kParentalFlags_DisableExplicitBooks

0x04000000

67108864

added in iTunes 11.0

kParentalFlags_DisableDefaultPlayerDialog

0x08000000

134217728

added in iTunes 11.3

Values for UserMoviesLimit, UserTVShowsLimit, AdminMoviesLimit and AdminTVShowsLimit

These registry values aren't publicly documented. System administrators typically only work with the parental control preferences that are set in the UserFlags and AdminFlags registry values.

UserFlags, UserMoviesLimit and UserTVShowsLimit

These registry values represent unlocked parental controls. They're set under the HKEY_CURRENT_USER key, so users can write to them even if they don't have elevated privileges. Therefore, you shouldn't use the registry values if you want to keep users from changing the parental controls you've set.

iTunes only follows the restrictions set in the UserFlags, UserMoviesLimit, UserTVShowsLimit, UserRatingSystemID and UserGamesLimit registry values when:

  • No value is set for AdminFlags in HKEY_LOCAL_MACHINE

  • The kParentalFlags_Locked bit in the AdminFlags value is set to 0

AdminFlags, AdminMoviesLimit and AdminTVShowsLimit

These registry values represent locked parental controls. They're set under the HKEY_LOCAL_MACHINE key; users need elevated privileges in order to write to them.

iTunes checks for an AdminFlags value for the current user that indicates controls are locked. If one exists, iTunes uses that value and ignores any Userxxx values under HKEY_CURRENT_USER.

In this scenario, Adminxxx values may not reflect the current parental controls settings if the controls are unlocked. Only the Userxxx values are maintained, but the locked controls in AdminFlags remain up to date.

Preconfigure parental controls

To preconfigure parental controls, set the three registry values in the HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls registry key for each user account.

To do this, use either of these methods:

  • Use iTunes to set up and lock the parental control preferences for a user, then replicate the values for that user under the registry keys for other user account security identifiers (SIDs). Before you do this, make sure you don't need to set any flags that can't be controlled from the iTunes user interface.

  • Use Registry Editor to set the parental control values.

To preconfigure parental controls for user accounts that haven't yet been created or used, set the following values.

For 32-bit versions of iTunes on 32-bit versions of Windows, or 64-bit versions of iTunes on 64-bit versions of Windows:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

For 32-bit versions of iTunes on 64-bit versions of Windows:

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

If no account-specific keys exist in HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls, iTunes uses the keys under HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Parental Controls\Default.

To keep limited users from changing the parental controls, make sure the kParentalFlags_Locked value is set in the AdminFlags key.

When you set these flags, remember that:

  • You can't set these flags in the iTunes user interface.

  • These flag settings are only enforced when you set the kParentalFlags_Locked key. If you don't lock AdminFlags, iTunes will ignore the settings.

  • You must set these flag settings in AdminFlags. If you set them in UserFlags, they won't be enforced.

UserFlags or AdminFlags name

Hexidecimal value

(only when manually editing the client registry value)

Decimal value

(only when deploying registry value via Group Policy)

kParentalFlags_DisableCheckForUpdates

0x00000100

256

kParentalFlags_DisableAutomaticDeviceSync

0x00000800

2048

kParentalFlags_DisableGetAlbumArtwork

0x00001000

4096

kParentalFlags_DisablePlugins

0x00002000

8192

kParentalFlags_DisableOpenStream

0x00004000

16384

kParentalFlags_DisableAppleTV

0x00008000

32768

kParentalFlags_DisableDeviceRegistration

0x00010000

65536

kParentalFlags_DisableDiagnostics

0x00020000

131072

kParentalFlags_RequireEncryptedBackups

0x00080000

524288

kParentalFlags_DisableHomeSharing

0x00100000

1048576

kParentalFlags_DisableCheckForAppUpdates

0x00200000

2097152

kParentalFlags_DisableCheckForDeviceUpdates

0x00400000

4194304

For example, to disable the Check for Device Updates setting, set the AdminFlags registry value for kParentalFlags_Locked and kParentalFlags_DisableCheckForAppUpdates to 0x40000000.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Contact the vendor for additional information.

Published Date: