The Windows Bug I Reported to Microsoft

When I was eleven I got a little laptop for my birthday. It came with a catch: Microsoft Family parental controls, to limit my screen time. I was fine with this. I still think limiting screen time is a good idea, especially for kids.

By high school I had friends who wanted to play games together, projects I wanted to build, and videos I wanted to watch. All of it was capped (for good reason). Given my “fine, I’ll do it myself” mindset, I started scheming.

The easy route was asking the account administrator for more time once I’d finished my obligations, and hoping they approved it. That worked sometimes. The second route was giving myself administrator privileges so I could approve my own requests. I liked the challenge.

At fourteen, my first move was googling “how to remove / extend screentime limits windows 10.” Not very fruitful. Eventually I found a way into the device’s file system by forcing it to boot into recovery and pretending to install a driver. From there I pointed certain files and utilities at other programs to get an administrator command prompt on the lock screen. (I’m leaving out the details on purpose. Some of it could still be misused.) After that, adding a local administrator account outside the Microsoft Family system was trivial. We were golden.

I handed out bonus screentime to myself and anyone who asked. The person managing the account noticed within days. They had no idea how it worked, they just asked me to stop. I mostly did. Weekends were fair game.

A few weeks later I decided the bug was interesting enough to show people. The first person I showed looked equal parts impressed and concerned. So naturally I made a YouTube video showing the world what you could do with it. It got about 2,000 views before it was forcefully deleted.

Seeing how YouTube and that first viewer reacted, I figured I should report it to Microsoft. I filled out a little contact form and expected never to hear back.

A few weeks later I got a call from a number I didn’t recognize. Seattle area code. It was a Microsoft representative who wanted the whole story, every detail and every use case I could think of. We talked for an hour. I emailed screenshots, photos of my monitor and step-by-step instructions. Most of the call I thought he wasn’t taking it seriously, while I was a bit frantic: you could change and remove account passwords at the very least. After that I didn’t expect anything to come of it. I forgot about it and moved on.

Two years later, in one of my classes, I was setting up a ticketing desk for the school. That needed admin access on a machine managed by the network. Nobody in the class knew the admin password. Not the instructor, not the head of the department. I timidly said I could probably get in. Everyone else was stumped, so I gave it a shot. Boot into recovery, “install a driver,” and boom: a password prompt. Microsoft had fixed it.

Annoying in the moment. In hindsight it was a real fix I helped bring about, for a bug buried deep in Windows 10 that only a few tomfoolers would ever find. And yes, I still got into that school machine.