- 12.3. Parental Controls
If you're setting up a Standard account, the Parental Controls checkbox affords you the
opportunity to shield your Mac—or its very young, very fearful, or very mischievous
operator—from confusion and harm. This is a helpful feature to remember when you're
setting up accounts for students, young children, or easily intimidated adults. (This
checkbox is available for Admin accounts, too, but trying to turn it on produces only a
"Silly rabbit—this is for kids!" sort of message.)
Leopard introduces a lot more peace of mind for parents than other operating systems.
You can now specify how many hours a day each person is allowed to use the Mac, and
declare certain hours (like sleeping hours) off-limits. You can specify exactly who your
kids are allowed to communicate with via email (if they use Mail) and instant messaging
(if they use iChat), what Web sites they can visit (if they use Safari), what programs
they're allowed to use, and even what words they can look up in the Mac OS X
Here are all the ways you can keep your little Standard account holders shielded from the
Internet—and themselves. For sanity's sake, the following discussion refers to the
Standard account holder as "your child."But some of these controls—notably those in the
System category—are equally useful for people of any age who feel overwhelmed by the
Mac, are inclined to mess it up by not knowing what they're doing, or are tempted to
mess it up deliberately.
Note: If you use any of these options, the account type listed on the Accounts panel
changes from "Standard" to "Managed."
On this tab, you see the options shown in Figure 12-5. Use these options to limit what
your Managed-account flock is allowed to do. You can limit them to using certain
programs, for example, or prevent them from burning DVDs, changing settings, or
fiddling with your printer setups.
(Limiting what people can do to your Mac when you're not looking is a handy feature
under any shared-computer circumstance. But if there's one word tattooed on its
forehead, it would be "Classrooms!")
- On the panel that pops up when you click Configure, you have two options: "Use Simple
Finder" and "Only allow selected applications."
184.108.40.206. Use Simple Finder
If you're really concerned about somebody's ability to survive the Mac—or the Mac's
ability to survive them—turn on "Use Simple Finder." Then turn on the checkboxes of
the programs that person is allowed to use.
Suppose you're the lucky Mac fan who's been given a Simple Finder account. When you
log in, you discover the barren world shown in Figure 12-6. There are only three menus (
, Finder, and File), a single onscreen window, no hard drive icon, and a bare-bones
Dock. The only folders you can see are in the Dock. They include:
• My Applications. These are aliases of the applications that the administrator
approved. They appear on a strange, fixed, icon view, called "pages." List and
column views don't exist. The Simple person can't move, rename, delete, sort, or
change the display of these icons—merely click them. If you have too many to fit
on one screen, you get numbered page buttons beneath them, which you click to
move from one set to another.
Figure 12-5. In the Parental Controls window, you can control the capabilities
of any account holder on your Mac. In the lower half of the System tab
window, you can choose applications and even Dashboard widgets by turning
on the boxes next to their names. (Expand the flippy triangles if necessary.)
Those are the only programs these account holders will be allowed to use.
(The new Search box helps you find certain programs without knowing their
• Documents. Behind the scenes, this is your Home Documents folder. Of
course, as a Simple Finder kind of soul, you don't have a visible Home folder. All
your stuff goes in here.
• Shared. This is the same Shared folder described on Section 12.6.2. It's provided
so that you and other account holders can exchange documents. However, you
can't open any of the folders here, only the documents.
• Trash. The Trash is here, but you won't use it much. Selecting or dragging any
icon is against the rules, so you're left with no obvious means of putting anything
into your Trash.
- Figure 12-6. The Simple Finder doesn't feel like home—unless you've got one of
those Spartan, space-age, Dr. Evil–style pads. But it can be just the ticket for less-
skilled Mac users, with few options and a basic one click interface. Every program
in the My Applications folder is actually an alias to the real program, which is safely
ensconced in the off-limits Applications folder.
The only programs with their own icons in the Dock are Finder and Dashboard.
Otherwise, you can essentially forget everything else you've read in this book. You can't
create folders, move icons, or do much of anything beyond clicking the icons that your
benevolent administrator has provided. It's as though Mac OS X moved away and left
you the empty house.
• To keep things extra-simple, Mac OS X permits only one window at a time to be
open. It's easy to open icons, too, because one click opens it, not two.
• The File menu is stunted, offering only a Close Window command. The Finder
menu only gives you two options: About Finder and Run Full Finder. (The latter
command prompts you for an administrator's user name and password, and then
turns back into the regular Finder—a handy escape hatch. To return to Simple
Finder, just choose Finder Return to Simple Finder.)
• The menu is really bare-bones: You can Log Out, Force Quit, or go to Sleep.
• There's no trace of Spotlight.
Although the Simple Finder is simple, any program (at least, any that the administrator
has permitted) can run from Simple Finder. A program running inside the Simple Finder
still has all of its features and complexities—only the Finder has been whittled down to
In other words, Simple Finder is great for streamlining the Finder, but novices won't get
far combating their techno-fear until the world presents us with Simple Keynote, Simple
Mail, and Simple Microsoft Word. Still, it's better than nothing.
When Simple people try to save documents, they'll find that although the Save box lists
the usual locations (Desktop, Applications, and so on), they can in fact save files only
into their own Home folders or subfolders inside them.
- 220.127.116.11. Only allow selected applications
By tinkering with the checkboxes here, you can declare certain programs off-limits to this
account holder, or turn off his ability to remove Dock icons, burn CDs, and so on.
You can restrict this person's access to the Mac in several different ways:
• Limit the programs. At the bottom of the dialog box shown in Figure 12-5, you see
a list of all the programs in your Applications folder (an interesting read in its own
right). Only checked items show up in the account holder's Applications folder.
Tip: If you don't see a program listed, use the Search box, or drag its icon from the
Finder into the window.
If, for instance, you're setting up an account for use in the classroom, you may
want to turn off access to programs like Disk Utility, iChat, and Tomb Raider.
• Limit the features. When you first create them, Standard account holders are free
to burn CDs or DVDs, modify what's on the Dock, change their passwords, and
view the settings of all System Preferences panels (although they can't change all
of these settings).
Depending on your situation, you may find it useful to turn off some of these options. In
a school lab, for example, you might want to turn off the ability to burn discs (to block
software piracy). If you're setting up a Mac for a technophobe, you might want to turn off
the ability to change the Dock (so your colleague won't accidentally lose access to his
own programs and work).
12.3.2. Content (Dictionary and Web)
"Content," in this case, means "two options we really didn't have any other place to put."
Actually, what it really means is Dictionary and Safari.
18.104.22.168. Hide profanity in Dictionary
As you know from Chapter 10, Mac OS X comes with a complete electronic copy of the
New Oxford American Dictionary. And "complete," in this case, means "it even has
- Turning on "Hide profanity in Dictionary" is like having an Insta-Censor™. It hides most
of the naughty words from the dictionary whenever your young account holder is logged
in (Figure 12-7).
Figure 12-7. Something's oddly missing from the Dictionary when Parental Controls
are turned on: dirty words.
22.214.171.124. Web S ite Restrictions
This feature is designed to limit which Web sites your kid is allowed to visit.
Frankly, trying to block the racy stuff from the Web is something of a hopeless task; if
your kid doesn't manage to get round this blockade by simply using a different browser,
he'll just wind up seeing the dirty pictures at another kid's house. But at least you can
enjoy the illusion of taking a stand, using approaches of three degrees of severity:
• Allow unrestricted access to Web sites. In other words, no filtering. Anything
• Try to limit access to adult Web sites automatically. Those words—"try to"—are
Apple's way of admitting that no filter is foolproof.
In any case, Mac OS X comes with a built-in database of Web sites that it already
knows may be inappropriate for children—and these sites won't appear in Safari
while this account holder is logged in. By clicking Customize and then editing the
"Always allow" and "Never allow" lists, you can override its decisions on a siteat-
• Allow access to only these Web sites. This is the most restrictive approach of all:
It's a whitelist, a list of the only Web sites your youngster is allowed to visit. It's
filled with kid-friendly sites like Disney and Discovery Kids, but of course you
can edit the list by clicking the + and–buttons below the list.
12.3.3. Mail & iChat
Here, you can build a list of email and chat addresses, corresponding to the people you
feel comfortable letting your kid exchange emails and chat with. Click the + button below
the list, type the address, press Enter, lather, rinse, and repeat.
- Tip: No, you can't drag cards in from your Address Book; that would be much too
simple. But after clicking the + button to create a new row in the list (in Edit mode), you
can drag just the email address out of an Address Book card that you've opened up.
For reasons explained in a moment, turn on "Send permission emails to," and plug in
your own email address.
Now then: When your youngster uses Apple's Mail program to send a message to
someone who's not on the approved list, or tries to iChat with someone not on the list, he
gets the message shown at top in Figure 12-8. If he clicks Ask Permission, then your
copy of Mail shortly receives a permission-request message (Figure 12-8, middle);
meanwhile, the outgoing message gets placed in limbo in his Drafts folder.
If you add that person's address to the list of approved correspondents, then the next time
your young apprentice clicks the quarantined outgoing message in his Drafts folder, the
banner across the top lets him know that all is well—and the message is OK to go out
(Figure 12-8, bottom).
POWER USERS' CLINIC
Parental Remote Controls
It occurred to somebody at Apple that the new Parental Controls feature might
be especially useful in a classroom. That person further realized that it'd be very
cool if you could adjust the settings for Macs A, B, C, and D while seated at
Mac E. That is, the teacher might prefer not to have to scurry from kid's desk to
kid's desk to make changes.
And that's why you can operate Parental Controls from another Mac on the
Phase 1: While seated at the first kid's Mac, open System Preferences; open
Parental Controls; click the ; enter your password.
Now click the name of the account you want to manage remotely. Then, from
the menu below the list of accounts, choose Allow Remote Setup. Close
System Preferences. Repeat for each account on each Mac that you'll want to
manage from afar.
- Phase 2: Go back to your teacher's desk. On your own Mac, choose Go
Connect To Server. In the resulting dialog box, click Browse.
Now you get a list of the other Macs on the network. Click one and enter an
administrator's name and password for that Mac.
Now open System Preferences, click Parental Controls, click the , and then
enter your password again. This time, you'll see a section in the Accounts list
called Other Computers. Click the account name (on the kid's Mac) whose
settings you want to change. Enter the administrator name and password of the
remote computer one more time, and off you go!
Note: This feature doesn't attempt to stop email or chat using other programs, like
Microsoft Entourage or Skype. If you're worried about your efforts being bypassed, block
access to those programs using the Forbidden Applications list described above.
Figure 12-8. Top: If your kid tries to contact someone who's not on the Approved
list, he can either give up or click Ask Permission.
Bottom: In the latter case, you'll know about it. If you're convinced that the would-
be correspondent is not, in fact, a stalker, you can grant permission by clicking
Your young ward gets the good news the next time he visits his Drafts folder, where
the message has been awaiting word from you, the Good Parent.
When your underling fires up iChat or Mail, she'll discover that her Buddy List is empty
except for the people you've identified.
Handling the teenage hissy fit is your problem.
12.3.4. Time Limits
Clever folks, those Apple programmers. They must have kids of their own.
- They realize that some parents care about how much time their kids spending front of the
Mac, and some also care about which hours (Figure 12-9):
• How much time. In the "Weekday time limits" section, turnon "Limit computer
use to," and then adjust the slider. A similar slider appears for Weekend time
• Which hours. In the "Bedtime" section, turn on the checkbox for either "School
nights" or "Weekend," and then set the hours of the day (or, rather, night) when
the Mac is unavailable to your young account holders.
In other words, this feature may have the smallest pages-to-significance ratio in this
entire book. Doesn't take long to explain it, but it could bring the parents of Mac addicts a
lot of peace.
The final tab of the Parental Controls panel is Big Brother Central. Here's a complete
rundown of what your kids have been up to. Its four categories—Websites visited,
Websites blocked, Applications, and iChat—are extremely detailed. For example, in
Applications, you can see exactly which programs your kids tried to use when, and how
much time they spent in each one. Figure 12-10 shows the idea.
Figure 12-9. Top: If this account holder tries to log in outside of the time limits you
specify here, she'll encounter only a box that says, "Computer time limits expired."
She'll be offered a pop-up menu that grants her additional time, from 15 minutes to
"Rest of the day"—but it requires your parental consent (actually, your parental
password) to activate.
Bottom: Similarly, if she's using the Mac as her time winds down, she gets this
message. Once again, you, the allknowing administrator, can grant her more time
using this dialog box.
If you see something that you really think should be off limits—a site in the Websites
Visited list, an application, an iChat session with someone—click its name and then click
Restrict. You've just nipped that one in the bud.
Conversely, if the Mac blocked a Web site that you think is really OK, click its name in
the list, and then click Allow. (And if you're wondering what a certain Web page is, click
it and then click Open.)
- Figure 12-10. These logs track everything your kid tried to do; it's spying, sure, but
it's for the good of the child. (Right?) Use the popup menus at the top to change the
time period being reported (Today, This Week, or whatever) and how they're
grouped in the list—by date or by application/Web site.