Parental Controls on Windows 11 Without a Microsoft Account

Windows 11's built-in parental controls (Microsoft Family Safety) require a Microsoft account for the child, so they do not work with a purely local account. Without one, you can still use a standard local account, a parent administrator password, logon hours, a third-party Windows app and a DNS filter. Each covers a different part of the problem.

Many parents prefer a local Windows account: no cloud profile for the child, no email address to create, no settings syncing to Microsoft. The trade-off is that the official Family Safety features are unavailable. This guide shows what actually works, in the order that gives the most protection for the least effort.

Why Family Safety needs a Microsoft account

Family Safety is a cloud service. The parent manages rules at family.microsoft.com, and the child's device receives them through the child's Microsoft account. A local account has no cloud identity, so there is nothing for the service to attach the rules to. Converting the local account to a Microsoft account makes Family Safety work, but it also creates exactly the cloud profile some families want to avoid.

Step 1: Set up a standard local account (the foundation)

This is not a parental control feature, but without it every other measure is easy to undo. The child must not be an administrator.

1. Create a local account for the child. Settings → Accounts → Other users → Add account → “I don't have this person's sign-in information” → “Add a user without a Microsoft account”. Set a password.
2. Make it a Standard user. Select the new account → Change account type → Standard user.
3. Protect the parent account. The parent account stays an administrator and has a password the child does not know. Do not use a blank password or a PIN the child can guess.
4. Move the child's files. If the child used the parent account before, copy documents, saves and browser bookmarks into the new profile.

Step 2: Limit logon hours with net user

Windows can restrict the hours when a local account is allowed to log on. This is a built-in command, no extra software.

1. Open Command Prompt as administrator. Press Start, type cmd, right-click and choose “Run as administrator”.
2. Check the account name. Run net user to see the exact local username.
3. Set the allowed hours. For example: net user Alex /times:M-F,15:00-20:00;Sa-Su,09:00-21:00. Days use M,T,W,Th,F,Sa,Su. The account cannot log on outside those hours.
4. Test it. Sign out and try to sign in as the child outside the allowed window. Behaviour for a session that is already open depends on policy, so test on your PC.

Limitations: this controls when the account can log on, not how many total hours it uses. It does not limit individual apps, and it does not filter websites. It is a useful backstop, not a complete parental control system.

Step 3: Add a time-limit app that works with a local account

A dedicated app can enforce a daily total, a schedule and a screen lock without a Microsoft account. ScreenRhythm is one option; the same checklist applies to any app you choose.

1. Download from the official site. Use the download page and check the SHA-256. The installer is not code-signed yet, so SmartScreen may warn; the page explains how to verify the file.
2. Install as the parent administrator. The app installs a Windows service so the rules survive a reboot and a Task Manager attempt.
3. Set a parent password. Use a password the child does not know and store it somewhere safe.
4. Set the daily limit, breaks and schedule. For example: 1.5 hours per day, a 10-minute break every 45 minutes, computer available 15:00–20:30 on school days.
5. Keep the child on the standard account. The app runs in the tray and the child sees the countdown. The rule is visible, not secret.

Step 4: Filter websites without a Microsoft account

Content filtering is a separate problem from time limits. The most reliable no-account approach is DNS filtering, which works in every browser because it happens below the browser.

• Router-level DNS. Set the router's DNS to a family filter such as Cloudflare for Families (1.1.1.3), OpenDNS FamilyShield or NextDNS. Every device on the home network is covered, including phones and tablets.
• PC-level DNS. Set the filter DNS on the child's Windows adapter. It is easier to change than the router, so treat it as a lighter measure.
• A system-wide app filter. ScreenRhythm Pro includes a DNS-based filter with four categories: adult content, gambling, ads and trackers, and social networks. It works in every browser, not only Edge.
• Hosts file. You can block specific domains in C:\Windows\System32\drivers\etc\hosts. It is free and browser-independent, but manual, easy to forget, and a standard user cannot edit it without administrator rights.

Step 5: AppLocker or Group Policy (advanced, Windows Pro)

On Windows 11 Pro or Enterprise you can use AppLocker or Group Policy to block specific programs. This is powerful but complex, and it is not available on Windows 11 Home. For most families, a standard account plus a time-limit app plus DNS filtering covers more with less maintenance.

Which setup fits your family?

Questions

ScreenRhythm is our product. We describe it alongside built-in Windows options and other approaches honestly. This article is general information, not legal advice.