How to set up parental controls on a Windows PC

Microsoft's Family Safety only filters websites in Edge. Windows 11 has a better option tucked away in the network settings that covers every browser, game and app.

Updated November 11, 2026·2 min read

Short answer

Give your child a Standard (not administrator) account. Then in Settings › Network & internet › Wi‑Fi › Hardware properties, edit DNS server assignment to Manual, paste the Sheepdog Filter address and template, and turn DNS over HTTPS on. That filters the whole PC. On Windows 10, set up the browser instead.

Step 1: A Standard account for your child

This matters more than any filter. A child with an administrator account can undo anything.

  1. Open Settings › Accounts › Family and add your child (it uses their Microsoft account).
  2. Make sure their account type is Standard user, not Administrator.
  3. Microsoft Family Safety now lets you set screen time and app limits from your phone. Its web filter only works in Edge, and it blocks other browsers to make that work.

Step 2: Filter the whole PC (Windows 11)

Do this while signed in as an administrator (you).

  1. In your Sheepdog Filter dashboard, open Devices › + Protect something, choose your child and Windows PC.
  2. Press Windows key + I to open Settings, then Network & internet › Wi‑Fi (or Ethernet if it's plugged in) › Hardware properties.
  3. Next to DNS server assignment, click Edit, choose Manual, and turn on IPv4.
  4. In Preferred DNS, paste the address from the dashboard.
  5. Set DNS over HTTPS to On (manual template) and paste the template from the dashboard.
  6. Turn Fallback to plaintext off. In Alternate DNS, paste the backup address from the dashboard, with the same template. Click Save. If the PC uses both Wi‑Fi and a cable, do it for both.

The setup page turns green when it's working. Because it's set on the PC itself, it covers every browser, Steam, Discord, Roblox and the rest.

Windows 10

Windows 10 doesn't have the encrypted DNS option, so set up the browser instead: in Chrome, Edge or Firefox, open the secure DNS setting and paste your Sheepdog Filter address. Your dashboard shows the exact steps for each browser. Better still, set up your home Wi‑Fi router so everything on the network is covered.

Only if your child gets around it

Most families never need this. But a child with an administrator account can type a different DNS (like 8.8.8.8) into Windows, which skips both your router and the steps above, and then turn on a VPN.

  1. In the dashboard's Windows steps for that PC, open Only if your child gets around it and click Download browser lock.
  2. Open the file on the PC while signed in as yourself. Click Yes, Yes again, then OK, and reopen the browser.
  3. Make your child's account Standard (Step 1) so they can't undo it.

Chrome, Edge, Brave and Firefox then use Sheepdog Filter even if the DNS is changed or a VPN is on, and "free VPN" browser add‑ons stop working.

Sheepdog Filter

The internet, childproofed in five minutes.

One switch per worry, every device in the house, and a plain-English report each week. Free to start, no app to install.

Start free

Questions parents ask

Does Microsoft Family Safety block websites in Chrome?

No. Family Safety's web filter only works in Microsoft Edge. To make it stick, it blocks other browsers. Sheepdog Filter filters every browser and app instead.

Can my child change the DNS setting back?

Not from a Standard account. Changing network settings needs an administrator password.

My child set the DNS to 8.8.8.8. What now?

That skips your router. Set it back to Automatic in the same Hardware properties screen, add the optional browser lock from your dashboard, and make their account Standard.

Keep reading