Manage control features in iTunes for Windows

Use the parental, enterprise, and education controls in iTunes to restrict content.

This article applies only to iTunes 7.1 or later running on Windows computers. If you use OS X, you can manage control features in iTunes 7.1 or in iTunes 8.1 and later.

System administrators can use parental, enterprise, and education controls in iTunes for Windows to set content restrictions.

The steps in this article use Registry Editor (Regedit.exe) to make changes to the Windows registry. Even if you're very comfortable using Registry Editor, back up the registry first. If you make a mistake, it can cause issues with your computer or prevent Windows from starting.

Learn how to back up and restore the registry in Windows.

Registry keys for parental controls

Two registry keys manage parental controls for iTunes for Windows.

On Windows XP and 32-bit Windows Vista, Windows 7, and Windows 8

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls
  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls

 On 64-bit Windows Vista, Windows 7, and Windows 8

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\[SID]\Parental Controls
  • HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls

Set parental control preferences

The user-specific value [SID] is a string representation of a user account's security identifier. Typically, it looks like: S-1-5-21-1715567821-1202687629-839522115-1003.

Every user account has a different user-specifc value [SID]. For that reason, iTunes can store unique parental control preferences for every user uniquely in HKEY_LOCAL_MACHINE. To set parental control preferences that are inherited by new user accounts, create them under the following registry keys.

On Windows 32-bit systems

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default

On Windows 64-bit systems

  • HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Apple Computer, Inc.\iTunes\Parental Controls\Default

iTunes 8.0.2 and later versions use the values under these keys when user-specific [SID] values don't exist.

iTunes stores parental control preferences in five registry values. iTunes uses these values when parental controls are locked:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls\AdminGamesLimit

iTunes 8.0.2 and later versions use these values when user-specific [SID] values don't exist:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

iTunes uses these values when parental controls are unlocked:

  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserFlags
  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserMoviesLimit
  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserTVShowsLimit
  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserRatingSystemID
  • HKEY_CURRENT_USER\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\UserGamesLimit

Values for UserFlags and AdminFlags

UserFlags or AdminFlags name Hexidecimal value
(only when manually editing the client registry value)
Decimal value
(only when deploying registry value via Group Policy)
Notes
kParentalFlags_Locked 0x00000001 1  
kParentalFlags_DisablePodcasts 0x00000002 2  
kParentalFlags_DisableMusicStore 0x00000004 4  
kParentalFlags_DisableSharing 0x00000008 8  
kParentalFlags_DisableExplicitContent 0x00000010 16  
kParentalFlags_DisableRadio 0x00000020 32 This flag disables Internet radio only. It doesn't disable Apple Music radio stations.
kParentalFlags_RestrictMovieContent 0x00000040 64  
kParentalFlags_RestrictTVShowContent 0x00000080 128  
kParentalFlags_DisableCheckForUpdates 0x00000100 256  
kParentalFlags_RestrictGames 0x00000200 512  
kParentalFlags_DisableAutomaticDeviceSync 0x00000800 2048  
kParentalFlags_DisableGetAlbumArtwork 0x00001000 4096  
kParentalFlags_DisablePlugins 0x00002000 8192  
kParentalFlags_DisableOpenStream 0x00004000 16384  
kParentalFlags_DisableAppleTV 0x00008000 32768  
kParentalFlags_DisableDeviceRegistration 0x00010000 65536  
kParentalFlags_DisableDiagnostics 0x00020000 131072  
kParentalFlags_AllowITunesUAccess 0x00040000 262144

added in iTunes 8.1

kParentalFlags_RequireEncryptedBackups 0x00080000 524288

added in iTunes 8.2

kParentalFlags_DisableHomeSharing 0x00100000 1048576

added in iTunes 10

kParentalFlags_DisableCheckForAppUpdates 0x00200000 2097152

added in iTunes 10

kParentalFlags_DisableCheckForDeviceUpdates 0x00400000 4194304

added in iTunes 10

kParentlFlags_DisableFirstRunWelcomeWindow 0x01000000 16777216

added in iTunes 10.2

kParentalFlags_DisableDeviceFileSharing 0x02000000 33554432

added in iTunes 10.4

kParentalFlags_DisableExplicitBooks 0x40000000 67108864

added in iTunes 11.0

kParentalFlags_DisableDefaultPlayerDialog 0x08000000 134217728

added in iTunes 11.3

Values for UserMoviesLimit, UserTVShowsLimit, AdminMoviesLimit, and AdminTVShowsLimit

These registry values aren't publicly documented. System administrators typically work only with the parental control preferences that are set in the UserFlags and AdminFlags registry values.

UserFlags, UserMoviesLimit, and UserTVShowsLimit

These registry values represent unlocked parental controls. They're set under the HKEY_CURRENT_USER key, so users can write to them even if they don't have elevated privileges. Therefore, you shouldn't use the registry values if you want to keep users from changing the parental controls that you set.

iTunes follows the restrictions set in the UserFlags, UserMoviesLimit, UserTVShowsLimit, UserRatingSystemID and UserGamesLimit registry values only when:

  • No value is set for AdminFlags in HKEY_LOCAL_MACHINE
  • The kParentalFlags_Locked bit in the AdminFlags value is set to 0

AdminFlags, AdminMoviesLimit, and AdminTVShowsLimit

These registry values represent locked parental controls. They're set under the HKEY_LOCAL_MACHINE key, users need elevated privileges in order to write to them.

iTunes checks for an AdminFlags value for the current user that indicates that controls are locked. If one exists, iTunes uses that value and ignores any Userxxx values under HKEY_CURRENT_USER.

In this scenario, Adminxxx values might not reflect the current parental controls settings if the controls are unlocked. Only the Userxxx values are maintained, but the locked controls in AdminFlags remain up do date.

Preconfigure parental controls

To preconfigure parental controls, set the three registry values in the HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls registry key for each user account.

To do this, use either of these methods:

  • Use iTunes to set up and lock the parental control preferences for a user, then replicate the values for that user under the registry keys for other user account security identifiers (SIDs). Before you do this, make sure that you don't need to set any flags that can't be controlled from the iTunes user interface. 
  • Use Registry Editor to set the parental control values.

To preconfigure parental controls for user accounts that haven't yet been created or used set the following values.

For 32-bit versions of iTunes on 32-bit versions of Windows, or 64-bit versions of iTunes on 64-bit versions of Windows:

  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

For 32-bit versions of iTunes on 64-bit versions of Windows:

  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminFlags
  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminMoviesLimit
  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminTVShowsLimit
  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminRatingSystemID
  • HKEY_LOCAL_MACHINE\Wow6432Node\SOFTWARE\Apple Computer, Inc.\iTunes\Parental Controls\Default\AdminGamesLimit

If no account-specific keys exist in HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\iTunes\[SID]\Parental Controls, iTunes uses the keys under HKEY_LOCAL_MACHINE\SOFTWARE\Apple Computer, Inc.\Parental Controls\Default.

To keep limited users from changing the parental controls, make sure that the kParentalFlags_Locked value is set in the AdminFlags key.

When you set these flags, remember that:

  • You can't set these flags in the iTunes user interface.
  • These flag settings are enforced only when you set the kParentalFlags_Locked key. If you don't lock AdminFlags, iTunes ignores the settings.
  • You must set these flag settings in AdminFlags. If you set them in UserFlags, they aren't enforced.
UserFlags or AdminFlags name Hexidecimal value
(only when manually editing the client registry value)
Decimal value
(only when deploying registry value via Group Policy)

kParentalFlags_DisableCheckForUpdates

0x00000100

256

kParentalFlags_DisableAutomaticDeviceSync

0x00000800

2048

kParentalFlags_DisableGetAlbumArtwork

0x00001000

4096

kParentalFlags_DisablePlugins

0x00002000

8192

kParentalFlags_DisableOpenStream

0x00004000

16384

kParentalFlags_DisableAppleTV

0x00008000

32768

kParentalFlags_DisableDeviceRegistration

0x00010000

65536

kParentalFlags_DisableDiagnostics

0x00020000

131072

kParentalFlags_RequireEncryptedBackups

0x00080000

524288

kParentalFlags_DisableHomeSharing

0x00100000 1048576

kParentalFlags_DisableCheckForAppUpdates

0x00200000 2097152

kParentalFlags_DisableCheckForDeviceUpdates

0x00400000 4194304

For example, to disable the Check for Device Updates setting, set the AdminFlags registry value for kParentalFlags_Locked and kParentalFlags_DisableCheckForAppUpdates to 0x40000000.

Information about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. Risks are inherent in the use of the Internet. Contact the vendor for additional information. Other company and product names may be trademarks of their respective owners.

Published Date: