Thanks for the advice. The local version of KSK is 1.0.5.8153(i) . The issue affects all PCs in our family - the application category ‘unknown’ is marked as forbidden in the web config but this is not applied to any of the devices when my child logs in [clinking on the tray icon, then ‘more info’ confirms the current settings. It did work previously but no longer (for no clear reason). Blocking this category did prevent access to MS Store, and this is preferable to using gpedit.msc as, like you say, it is sometimes needed to download and apply updates so I need to unblock it occasionally. Even with this deficiency, KSK was useful to limit the time spent on the device, however my child has quickly learned that creating a local account bypasses the controls associated with his profile - I guess I do need to look at gpedit.msc afterall. Sigh.