What version of Windows?
Learn how to secure and manage access to the resources on a standalone or member server for services or users.
learn.microsoft.com
Default local user accounts
The
default local user accounts are built-in accounts that are created automatically when the operating system is installed. The default local user accounts can't be removed or deleted and don't provide access to network resources.
Default local user accounts are used to manage access to the local device's resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the
Users folder. The Users folder is located in the Local Users and Groups folder in the local
Computer Management Microsoft Management Console (MMC).
Computer Management is a collection of administrative tools that you can use to manage a local or remote device.
Default local user accounts are described in the following sections. Expand each section for more information.
Administrator
The default local Administrator account is a user account for system administration. Every computer has an Administrator account (SID S-1-5-
domain-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation.
The Administrator account has full control of the files, directories, services, and other resources on the local device. The Administrator account can create other local users, assign user rights, and assign permissions. The Administrator account can take control of local resources at any time by changing the user rights and permissions.
The default Administrator account can't be deleted or locked out, but it can be renamed or disabled.
Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group.
Members of the Administrators groups can run apps with elevated permissions without using the
Run as Administrator option. Fast User Switching is more secure than using runas or different-user elevation.
Account group membership
By default, the Administrator account is a member of the Administrators group. It's a best practice to limit the number of users in the Administrators group because members of the Administrators group have Full Control permissions on the device.
The Administrator account can't be removed from the Administrators group.
Security considerations
Because the Administrator account is known to exist on many versions of the Windows operating system, it's a best practice to disable the Administrator account when possible to make it more difficult for malicious users to gain access to the server or client computer.
You can rename the Administrator account. However, a renamed Administrator account continues to use the same automatically assigned security identifier (SID), which can be discovered by malicious users. For more information about how to rename or disable a user account, see
Disable or activate a local user account and
Rename a local user account.
As a security best practice, use your local (non-Administrator) account to sign in and then use
Run as administrator to accomplish tasks that require a higher level of rights than a standard user account. Don't use the Administrator account to sign in to your computer unless it's entirely necessary. For more information, see
Run a program with administrative credentials.
Group Policy can be used to control the use of the local Administrators group automatically. For more information about Group Policy, see
Group Policy Overview.
Important
- Blank passwords are not allowed.
- Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled.
Facebook
Twitter