I used Version 1 of Windows Live Family Safety when it first came out. It was an idea long overdue: hosted control over which websites, IM contacts, and email addresses your kids are allowed to use, with some built-in monitoring.

When I upgraded to the new version in August of 2009, it no longer worked for me. Why? Because I’m something that Microsoft apparently doesn’t think should exist: a home user, running a Windows Server Active Directory Domain on his home network.

So for those of you who are (like me) geeky enough to want the power and flexibility that comes with having all your family members manage their logins on various machines throughout the house with a Windows Domain, and who are also responsible enough parents to limit what your kids can access online and depended on WLFS to manage it, then you were probably pretty upset (also like me) when the new version of Windows Live Family Safety broke the monitoring of domain accounts.

I do, however, have a workaround. Of course, like most workarounds, this one shouldn’t be needed… and I sincerely hope it won’t be when Windows Live Family Safety is updated next. But until then, following is what I did to get back monitoring of domain accounts. It works because the Windows Live Family Safety management interface will display domain accounts that are set as Administrators on the local machine.

This workaround assumes you’re using a Windows 7 client, but should work similarly for Vista.

1. On the computer(s) that your kids use to get online, sign in as you (assuming you have Admin privileges on that machine, which you should if you’re a domain admin and this machine is attached to your domain).
2. Go to Control Panel, then click Change account type under User Accounts.
3. In the list of Users for this computer:, make sure that domain accounts for you, as well as anyone you want monitored by Windows Live Family Safety, are listed. If any are missing, click Add…, put their domain username in the User name: field and the name of your domain in the Domain: field, then click Next.
4. On the next screen, which asks What level of access do you want to grant this user?, select Administrator. Do this for each of the accounts. Keep in mind that you are not setting them as an Administrator or Domain Administrator for your entire domain – you’re simply allowing their domain account to be part of the Administrators Group on the local machine (and only temporarily, at that).
5. If you added your own domain account in the previous step (and it’s likely you did), press OK until the User Accounts snap-in closes. You’ll be prompted to log out and log back in so that the local machine can apply your local Administrator rights. Go ahead and log out, log back in, and go on to the next step.
6. Once all domain accounts (including yours) are listed as Administrators on the local machine, run the Windows Live Family Safety application. Sign in as the parent with your Windows Live account.
7. Check the box next to each child you want to monitor, then click Next.
8. Match all the children’s names to their Windows Live accounts, then click Next.
9. The Windows Live Family Safety management application will think for a bit, then you can exit.
10. Go back to the User Accounts snap-in and select Properties on each of your kids’ accounts, select the Group Membership tab, and change them from Adminstrator to Standard user. This step isn’t technically necessary if there’s some strange reason that you’d want any of your kids to have Admin access to this machine, but as I’m sure you’ll agree, Domain Admins like us are control freaks, so I’ve got them all set as Standard user in my setup.
11. Test your sweet workaround by logging in as your kid(s) and verifying that their previous Windows Live Family Safety settings are intact and that they can’t browse anywhere they shouldn’t.
12. Kick back, pop open a Mountain Dew, and revel in your geek superiority. Just because THEY say you should run Windows Home Server like a sissy boy, instead of a full-on domain controller like a real man, doesn’t mean you have to!

If this workaround works for you, please let me know in the comments. If your implementation required some tweeks, I’d love to hear that, too!