Disabled administrator account?

[TAandy]

just used belarc advisor and came across this...

"local user accounts last logon
andy 09/01/2008 16:43:03 (admin)
IUSR_NMPR 22/12/2006 17:14:48
local system accounts
Administrator 22/12/2006 17:31:47 (admin)
Guest 12/10/2007 13:43:35"

belarc advises me that the administrator account at the bottom has been disabled.
who disabled it and how?
can i re-enable it?
i know it was last used on 22/12/2006, but i'm not sure if i like having an admin account on my pc that i can't access, no matter if it's disabled or not!!

am i wasting a good worry?
using vista home premium

 

[stash]

Is this a Vista box? The Administrator account (capital 'A') is disabled by default on Vista.

 

[TAandy]

it's a vista box, home premium.
now that you've enlightened me and i know it's there and disabled by default, i did a quick search on google and found out how to enable it. it's really not that hard, which is a bit worrying!!
since nobody else uses my pc (i hope ) i've left it disabled at the mo, but i'm still left wondering why they bothered even putting it there in the first place

 

[stash]

It's not hard for another admin to enable, no. But that's not the point.

The built in administrator account does not get a split token like every other account in the local admins group will. So it isn't subject to UAC. Since the goal is to get people running as standard users, Vista will guide you through creating an account on a new box that is in the admins group, but has a split token. But the Administrator account is still there, and it has a blank password since there was no out of the box experience to set it. So it is disabled by default.

 

[VirtualLarry]

So to avoid UAC, you could just enable the Administrator account, and then use it from then on? Sounds like fun to me!

 

[stash]

Sure, or disable the GPO setting that gives every other admin on the box a split token.

You don't really need to do any of this in most cases, but if that's what you want to do, it's your system.

 

[rasczak]

Originally posted by: stash
Sure, or disable the GPO setting that gives every other admin on the box a split token.

You don't really need to do any of this in most cases, but if that's what you want to do, it's your system.

how would you do this?

 

[stash]

gpedit.msc-->computer configuration-->windows settings-->security settings-->local policies-->security options

There are several UAC settings at the bottom that can be configured.

 

[rasczak]

thx stash!