Windows passwords: Blank/non-blank, admin/non-admin

Question

What are the security concerns of the following user account setups on a normal Windows 7/8/10 desktop machine compared to: Using a non-privileged account with a password and having an admin account with a different password.

• Using a non-privileged account with a blank password and having an admin account with a password.
• Using an admin account with a password.
• Using an admin account with a blank password.

For the scope of this question it is assumed that: The PC is a private single-user machine behind an usual consumer grade NAT, which is connected to the Internet. All the non-blank passwords are secure and get used for nothing else. No potential attacker has physical access to the machine.

Answer 1

Keeping the system fully patched is as important as setting a good password. The strongest that you have suggested is Using a non-privileged account with a password and having an admin account with a different password. The attacker does not require a password to break in.

If an attacker gets into the system because of some service that is not patched, he can easily wreak havoc.It is possible to escalate privileges even from a non-privileged account. So set passwords of great strength especially for the administrator account because in case the attacker couldn't gain administrative privileges, his next step is to dump the SAM file and to bruteforce the admin password.

My point is,the attack can occur after you have logged-in and is using the system. Once in he may/may not need passwords for further privilege escalation.

So

• Never use blank passwords
• Use passwords of excellent strength
• Always keep the system fully updated - This includes not just the OS updates, but updates of every software you use.