Should I change my built-in Administrator password?

Question

I had never thought much about this until the only account on my home PC somehow lost admin privileges (changing to guest - I suspect this is a Microsoft bug but will probably never know). So, eventually, I solved this problem by doing a safe boot, logging in with the never-before-used built-in "Administrator" account and its blank password, and then making my real account an administrator.

Since it seems that anybody can safe boot my computer (e.g., from the off state by booting and cutting the power three times in a row), I guess I need to change my Administrator password, right? If I don't change it, even if I encrypt my hard drive, this Administrator has access to all my files, right?

It seems Windows 10 should at least have told me something like "The built-in Administrator password is blank - Would you like to change it?" to give me a conscious decision when I first bought this computer, so I'm doubting myself...am I making some sort of mistake about how serious this is?

Answer 1

The default built-in admin account for home users has no password by default, but the account is also not enabled by default.

You can get to it if you have physical access to the machine, but if you have that, then you have access to everything. That's why full drive encryption is so important, because it prevents access to Windows, and therefore blocks access to the Admin account, too.

Answer 2

Some of the biggest Information Security headaches come from not changing default passwords.

If your system was ever stumbled upon either online or in person you can be sure that anyone with a working knowledge would start hammering away with all the default passwords to see if they can get access.

Once the administrator account is compromised it is pretty much game over as the admin account has the rights to access pretty much anything on the system.

Even if your drive was encrypted, a patient attacker would install a keylogger or other surveillance tool using the compromised admin account to capture the information they want.

What I would consider to be best practice would be to...

1. Create a new admin account (not called administrator, system, root etc.)
2. Set a good password for the new admin account.
3. Disable or lock the built in admin account.
4. Create an "Everyday" account with non-admin rights.
5. Set a good password for that non-admin account.

The non-admin account is for your day to day stuff and the admin account is only used when you want to make changes or install/remove software.

This has been recommended in various sysadmin publications since the 70's and still holds true today.