My children's accounts are set up as Administrator (rather than Limited) accounts. I am quite happy for them to use administrator privilege accounts - they each have their own computers and I think it's not a bad thing for them to take responsibility for installing programs etc. But they can then also enable/disable the guest account and use it if they want to. With the guest account enabled, I can associate it with the child and all protection works fine. If they create a new account that is not protected I get a notification email and I can talk to them about it and/or associate it with the child's OnlineFamily persona.
However, if they choose to disable, then re-enable the guest account, I get no notification email, no record in the online activity log and the guest account seems no longer to be protected or associated with the child. So by this route they can use the guest account to bypass protection.
As far as I know they haven't worked this one out, but maybe they will, and I suspect it could just happen by accident as they go through normal sibling disagreements/deals about giving access to each others computers when friends visit.
Has anyone found a way to avoid this apparent loophole?
Possible remedies:
1. Have OnlineFamily log an event and send an email when the guest account is enabled/disabled.
2. Have OnlineFamily remember the association between guest account and child's OnlineFamily persona even when the guest account is disabled/enabled.
3. Disable the guest account completely by some means so that even an administrator cannot enable it through the control panel. If this is possible, I suspect it will be some registry hack or similar that will make it a bit difficult, but not impossible, to re-enable the account.
All on Windows XP Home Edition.