How do you control computer usage habits for children?
As most of you are on holiday, I wanted to share some insights on home computersJ.
When you have more than one child like I do you always have competition for using the home computer. Competition is good as long as you have the necessary rules to facilitate smooth operation. Up until now, I had only one local account on our house computer running Windows 7 and the account. The user profile was locked down and only allowed for specific applications (read games) to run. However it had one major flaw. Any one child sitting in front of the computer can monopolize the time until a parent intervenes. This causes the all children except one to complain about how long the one at the computer is playing. So solution to that problem would need the following attributes:
· The computer should keep track of who is allowed to logon and when and for what duration.
· It should provide detailed logs around who is disallowed from logging on and how much time is remaining for a particular user.
· It should provide global settings that can be set from a central location.
· It should auto-install and create necessary information stores if necessary.
· It should discourage the usage for a long time so that others can use the computer but allow it after a certain time interval so that it gives credit for persistence.
The computer is in workgroup so using domain based controls is not an option. You can not use a script in start menu startup as it would be too easy to detect. The best approach is to use run registry key for local users. However I used parental control feature of Windows 7 and regedit was not available inside the restricted user account. The workaround is to logon to an administrative account and load restricted users registry hive (ntuser.dat) and set the run registry key. I created a powershell script that would implement the above attributes. Do not forget that run will issue the command before explorer is started so environment variables will not be there and you would need the full path. Below is the line I exported from regedit. I purposefully did not provide full file as loading hive will give different names for different users:
"LogoffTimer"="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\Powershell.exe -windowstyle hidden c:\\windows\\logoffTimer.ps1"
This line will run the powershell script logoffTimer.ps1 without showing a window to the user. The script starts when the user logs on and first checks if registry values are present. These are used for storing information around time used on last session, logon count, last logon time and time used for the day. It will create if values are not present. This way if you need to add another variable to the script you do not need to reset the registry.
if (Test-RegistryValue "hkcu:\software\erenturk\LogoffTimer","UsedDailyMinutes" -eq $False)
{
new-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedDailyMinutes" -value $UsedDailyMinutes
}
else
{
$UsedDailyMinutes=(Get-itemProperty -path hkcu:\software\erenturk\LogoffTimer -name "UsedDailyMinutes").UsedDailyMinutes
}
Next we check if a day has passed since last logon, if it did we reset counters in registry for a new day otherwise we check if daily quota is reached and log off if necessary.
$lastLogonDelta=New-TimeSpan -start $LastLogon -end $now
$lastLogonDeltaDesc=GetTimeSpanDescription($lastLogonDelta)
if ($LastLogon.day -eq $now.day)
{
add-content $logfile "$username has logged on for $UsedDailyMinutes minutes Today, $DailyLogonCount times and last logged $lastLogonDeltaDesc ago"
add-content $logfile "$username has used $usedSessionMinutes minutes session time on last logon"
$DailyLogonCount=$DailyLogonCount+1
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "DailyLogonCount" -value $DailyLogonCount
}
else
{
if ($LoggingLevel -gt 2) {add-content $LogFile "INFO: Day has passed since logon, reseting counters"}
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "DailyLogonCount" -value $DailyLogonCount
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedDailyMinutes" -value $UsedDailyMinutes
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedSessionMinutes" -value $UsedSessionMinutes
add-content $logfile "$username is logging first time today,last logged on $lastLogonDeltaDesc ago"
}
If the user is logging on for a second time, we check if the session time is finished. This is implemented so that if user logs of before allowed time, he/she can logon immediately afterwards. This is generally needed for accidental logoffs. If their session time has finished, script will check for last logon and will not log you on before a certain time passes. This gives chance to other users to use the computers before the first one is allowed again.
If user is finally allowed to log on, we create a loop that will awake every minute to see if time is finished and write the time left to log file, when it does writes the used minutes and logs off the user.
$EndTime=$now.addMinutes($SessionTimeLeft)
$TimeSpan=new-timespan $now $EndTime
while ($timeSpan -gt 0)
{
$timeSpan = new-timespan $(get-date) $endTime
sleep -Seconds 60
$UsedDailyMinutes=$UsedDailyMinutes+1
$usedSessionMinutes=$UsedSessionMinutes+1
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedDailyMinutes" -value $UsedDailyMinutes
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedSessionMinutes" -value $UsedSessionMinutes
$Remaining=GetTimeSpanDescription($timeSpan)
add-content $logfile "$Remaining remaining..."
}
$UsedDailyMinutes=$UsedDailyMinutes+1
$usedSessionMinutes=$UsedSessionMinutes+1
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedDailyMinutes" -value $UsedDailyMinutes
set-itemProperty -path hkcu:\software\erenturk\logoffTimer -name "UsedSessionMinutes" -value $UsedSessionMinutes
add-content $logfile "Session time allowance is reached, user will be logged off"
logoff
After I implemented the script and made the necessary rules, I was amazed to see how fast it was received by the children. You can find the script attached to the post.