its done via the windows parental control account.
http://windows.microsoft.com/en-US/windows7/products/features/parental-controls
I have a profile on my desktop at home for my son. You would simply set a password up for override on specific program restrictions and or internet usage. With this tool you can also throttle the user profile account usage to a set window of time.
For example, my son's profile (he is 4) is only available for use between noon and 6:30PM
All of his programs and permissions are based on whitelist instead of blacklist... so only what I have listed is available. He has access to a small selections of games I installed for him and Google Chrome. His allowed websites are also based on whitelist. He can get to hotwheel.com, starfall.com, nick.com, and some other educational site my wife signed him up for.
I wrote a few js extension and installed them into his chrome build... and installed adblock. this prevents alot of nonsense.