In Windows 10, there is the Administrator account that is disabled by default. What should I do with it, with regards to hardening Windows?
I have heard of adding a password to it, but is that necessary if it is set to Disabled?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
If the password is not set on the disabled account, anyone with remote access could enable the account and use it, no password necessary. You should always set the password so that even when enabled, the account still can't be easily used. However, unless further precautions are taken (such as a BIOS password) anyone with physical access can boot NT Offline Password Reset from a USB to enable the default admin account as well as blank the password for it.
This link will provide you with some further learning: https://technet.microsoft.com/en-us/library/2006.01.securitywatch.aspx
Considering teh concept of defense in depth, a password has to be set for all critical account irrespective of their status. So it is recommended to enable Admin to set up a strong password.
net user Administrator