This article applies only to iTunes 7.1 or later running on Windows computers.
System administrators can use parental, enterprise, and education controls in iTunes for Windows to set content restrictions.
The steps in this article use Registry Editor (Regedit.exe) to make changes to the Windows registry. Even if you're experienced using Registry Editor, back up the registry first. If you make a mistake, it can cause issues with your computer or prevent Windows from starting.
Registry keys for parental controls
Two registry keys manage parental controls for iTunes for Windows.
On Windows XP and 32-bit Windows Vista, Windows 7, Windows 8, and Windows 10
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls
On 64-bit Windows Vista, Windows 7, Windows 8, and Windows 10
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\[SID]\Parental Controls
- HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls
Set parental control preferences
The user-specific value [SID] is a string representation of a user account's security identifier. Typically, it looks like: S-1-5-21-1715567821-1202687629-839522115-1003.
Every user account has a different user-specifc value [SID]. For that reason, iTunes can store unique parental control preferences for every user uniquely in HKEY_LOCAL_MACHINE. To set parental control preferences that are inherited by new user accounts, create them under the following registry keys.
On Windows 32-bit systems
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default
On Windows 64-bit systems
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default
iTunes 8.0.2 and later versions use the values under these keys when user-specific [SID] values don't exist.
iTunes stores parental control preferences in five registry values. iTunes uses these values when parental controls are locked:
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminFlags
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminMoviesLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminTVShowsLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminRatingSystemID
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminGamesLimit
iTunes 8.0.2 and later versions use these values when user-specific [SID] values don't exist:
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit
iTunes uses these values when parental controls are unlocked:
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserFlags
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserMoviesLimit
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserTVShowsLimit
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserRatingSystemID
- HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserGamesLimit
Values for UserFlags and AdminFlags
| UserFlags or AdminFlags name | Hexidecimal value (only when manually editing the client registry value) |
Decimal value (only when deploying registry value via Group Policy) |
Notes |
|---|---|---|---|
| kParentalFlags_Locked | 0x00000001 | 1 | |
| kParentalFlags_DisablePodcasts | 0x00000002 | 2 | |
| kParentalFlags_DisableMusicStore | 0x00000004 | 4 | |
| kParentalFlags_DisableSharing | 0x00000008 | 8 | |
| kParentalFlags_DisableExplicitContent | 0x00000010 | 16 | |
| kParentalFlags_DisableRadio | 0x00000020 | 32 | This flag disables Internet radio only. It doesn't disable Apple Music radio stations. |
| kParentalFlags_RestrictMovieContent | 0x00000040 | 64 | |
| kParentalFlags_RestrictTVShowContent | 0x00000080 | 128 | |
| kParentalFlags_DisableCheckForUpdates | 0x00000100 | 256 | |
| kParentalFlags_RestrictGames | 0x00000200 | 512 | |
| kParentalFlags_DisableAutomaticDeviceSync | 0x00000800 | 2048 | |
| kParentalFlags_DisableGetAlbumArtwork | 0x00001000 | 4096 | |
| kParentalFlags_DisablePlugins | 0x00002000 | 8192 | |
| kParentalFlags_DisableOpenStream | 0x00004000 | 16384 | |
| kParentalFlags_DisableAppleTV | 0x00008000 | 32768 | |
| kParentalFlags_DisableDeviceRegistration | 0x00010000 | 65536 | |
| kParentalFlags_DisableDiagnostics | 0x00020000 | 131072 | |
| kParentalFlags_AllowITunesUAccess | 0x00040000 | 262144 | added in iTunes 8.1 |
| kParentalFlags_RequireEncryptedBackups | 0x00080000 | 524288 | added in iTunes 8.2 |
| kParentalFlags_DisableHomeSharing | 0x00100000 | 1048576 | added in iTunes 10 |
| kParentalFlags_DisableCheckForAppUpdates | 0x00200000 | 2097152 | added in iTunes 10 |
| kParentalFlags_DisableCheckForDeviceUpdates | 0x00400000 | 4194304 | added in iTunes 10 |
| kParentlFlags_DisableFirstRunWelcomeWindow | 0x01000000 | 16777216 | added in iTunes 10.2 |
| kParentalFlags_DisableDeviceFileSharing | 0x02000000 | 33554432 | added in iTunes 10.4 |
| kParentalFlags_DisableExplicitBooks | 0x04000000 | 67108864 | added in iTunes 11.0 |
| kParentalFlags_DisableDefaultPlayerDialog | 0x08000000 | 134217728 | added in iTunes 11.3 |
Values for UserMoviesLimit, UserTVShowsLimit, AdminMoviesLimit, and AdminTVShowsLimit
These registry values aren't publicly documented. System administrators typically work only with the parental control preferences that are set in the UserFlags and AdminFlags registry values.
UserFlags, UserMoviesLimit, and UserTVShowsLimit
These registry values represent unlocked parental controls. They're set under the HKEY_CURRENT_USER key, so users can write to them even if they don't have elevated privileges. Therefore, you shouldn't use the registry values if you want to keep users from changing the parental controls that you set.
iTunes follows the restrictions set in the UserFlags, UserMoviesLimit, UserTVShowsLimit, UserRatingSystemID and UserGamesLimit registry values only when:
- No value is set for AdminFlags in HKEY_LOCAL_MACHINE
- The kParentalFlags_Locked bit in the AdminFlags value is set to 0
AdminFlags, AdminMoviesLimit, and AdminTVShowsLimit
These registry values represent locked parental controls. They're set under the HKEY_LOCAL_MACHINE key, users need elevated privileges in order to write to them.
iTunes checks for an AdminFlags value for the current user that indicates that controls are locked. If one exists, iTunes uses that value and ignores any Userxxx values under HKEY_CURRENT_USER.
In this scenario, Adminxxx values might not reflect the current parental controls settings if the controls are unlocked. Only the Userxxx values are maintained, but the locked controls in AdminFlags remain up do date.
Preconfigure parental controls
To preconfigure parental controls, set the three registry values in the HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls registry key for each user account.
To do this, use either of these methods:
- Use iTunes to set up and lock the parental control preferences for a user, then replicate the values for that user under the registry keys for other user account security identifiers (SIDs). Before you do this, make sure that you don't need to set any flags that can't be controlled from the iTunes user interface.
- Use Registry Editor to set the parental control values.
To preconfigure parental controls for user accounts that haven't yet been created or used set the following values.
For 32-bit versions of iTunes on 32-bit versions of Windows, or 64-bit versions of iTunes on 64-bit versions of Windows:
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
- HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit
For 32-bit versions of iTunes on 64-bit versions of Windows:
- HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
- HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
- HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
- HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
- HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit
If no account-specific keys exist in HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls, iTunes uses the keys under HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Parental Controls\Default.
To keep limited users from changing the parental controls, make sure that the kParentalFlags_Locked value is set in the AdminFlags key.
When you set these flags, remember that:
- You can't set these flags in the iTunes user interface.
- These flag settings are enforced only when you set the kParentalFlags_Locked key. If you don't lock AdminFlags, iTunes ignores the settings.
- You must set these flag settings in AdminFlags. If you set them in UserFlags, they aren't enforced.
| UserFlags or AdminFlags name | Hexidecimal value (only when manually editing the client registry value) |
Decimal value (only when deploying registry value via Group Policy) |
|---|---|---|
kParentalFlags_DisableCheckForUpdates |
0x00000100 |
256 |
kParentalFlags_DisableAutomaticDeviceSync |
0x00000800 |
2048 |
kParentalFlags_DisableGetAlbumArtwork |
0x00001000 |
4096 |
kParentalFlags_DisablePlugins |
0x00002000 |
8192 |
kParentalFlags_DisableOpenStream |
0x00004000 |
16384 |
kParentalFlags_DisableAppleTV |
0x00008000 |
32768 |
kParentalFlags_DisableDeviceRegistration |
0x00010000 |
65536 |
kParentalFlags_DisableDiagnostics |
0x00020000 |
131072 |
kParentalFlags_RequireEncryptedBackups |
0x00080000 |
524288 |
kParentalFlags_DisableHomeSharing |
0x00100000 | 1048576 |
kParentalFlags_DisableCheckForAppUpdates |
0x00200000 | 2097152 |
kParentalFlags_DisableCheckForDeviceUpdates |
0x00400000 | 4194304 |
For example, to disable the Check for Device Updates setting, set the AdminFlags registry value for kParentalFlags_Locked and kParentalFlags_DisableCheckForAppUpdates to 0x40000000.