4

In Windows 10, there is the Administrator account that is disabled by default. What should I do with it, with regards to hardening Windows?

I have heard of adding a password to it, but is that necessary if it is set to Disabled?

Thank you.

2

If the password is not set on the disabled account, anyone with remote access could enable the account and use it, no password necessary. You should always set the password so that even when enabled, the account still can't be easily used. However, unless further precautions are taken (such as a BIOS password) anyone with physical access can boot NT Offline Password Reset from a USB to enable the default admin account as well as blank the password for it.

This link will provide you with some further learning: https://technet.microsoft.com/en-us/library/2006.01.securitywatch.aspx

  • Can the Administrator account be disabled again after the password has been added? Would it wipe the password again when it gets disabled? Thank you. – Smiith Mar 24 '17 at 23:09
  • @Smiith It sure can. At the university I work for, we have a disabled admin account on all machines on our network. That way if we can't login with domain credentials, and we need to re-bind the machine to the network, we can enable the local admin account, use the pre-set password, and disable it again when we are done. Here is the windows command net user administrator /active:no – SuperAdmin Mar 24 '17 at 23:11
  • Will there be any disadvantages / advantages to disabling the Administrator account as far as security hardening goes? – Smiith Mar 24 '17 at 23:12
  • @Smiith Absolutely, the default administrator account has absolute power over your machine, leaving it disabled prevents an attacker from attempting to use the account to log in. They would need to first enable it, making their job much harder. As far as disadvantages, I can't think of any, you shouldn't use that account unless absolutely necessary anyway. – SuperAdmin Mar 24 '17 at 23:16
  • That is good to know, thank you very much for the info. – Smiith Mar 24 '17 at 23:21
3

Considering teh concept of defense in depth, a password has to be set for all critical account irrespective of their status. So it is recommended to enable Admin to set up a strong password.

net user Administrator

Ref: http://hardenwindows10forsecurity.com/

  • When will that password be used? If there is the Administrator account, the regular admin account, and a standard user account. Thank you. – Smiith Mar 24 '17 at 23:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.