3

I've seen it said that when using the built-in Windows Administrator account, the best practice is to enable it (net user administrator /active:yes), use it, and then disable it.

I do realize it's a security measure against malware not to use it when not needed (and in fact, not use a regular admin account either), But - why disable it?

  • If you can easily enable/disable the account, then how will doing so hamper anybody but script kiddies? – etherealflux Aug 6 '15 at 17:21
  • @etherealflux You need admin privileges to enable and disable accounts. Presumably, if you already have those, access to the default Administrator account becomes less of a priority. – KnightOfNi Sep 6 '15 at 14:15
1

I understand the confusion.. let me try and explain..

But.. Why disable it..?

The reason behind disabling it.. Well.. Let me first kind of define an administrator account in a very generic way:

It is a user profile that is had administrator level privileges enabled which essentially gives that particular user complete access to the system.

So.. On windows it is named as 'Administrator'. It always exists on the system, whether enabled/disabled/in-use or dormant. So.. when malwares are written they are programmed to check for the existence of such profiles. Someone could also rename it to admin or root or something like that are generally privileged profiles.

If they do exist.. Voila... It saves me the work of "executing additional code" to gain privileges in the system. People make mistakes.. If they are enabled, let's take control and play havoc.

To make it more clear, let us assume that you are a skilled burglar and want to break into a house. Assume that the "house key" is the admin account. If I check for the house key in generic places like 'under the pot, or under the welcome cat, or on the ledge".. If I get them, I'll break in easily. If you don't keep the set of house keys outside, then I don't find it. The burglar will break it using additional pick-locks and levers (Privilege escalation methods). If your lock is unpickable then you are safe. (Relate it to something like hardening your security).

So you see, disabling it will ensure that the malware atleast has to "put in work effort" in order to gain access to the system. A highly motivated and skilled hacker might be able to get through but can be stopped by implementing tight security controls on the system. If your system is secure, then the malware is useless.

Theoretically speaking.. I hope its helpful.. :)

  • A 'welcome cat' does not remain stationary long enough for hiding the key(s) under it to be worthwhile -- and it bites you if you try. ITYM 'mat'. – dave_thompson_085 Sep 6 '15 at 11:52
0

But - why disable it?

If you don't use it, disable it! It's like a telnet service that's no longer being used because you installed an SSH daemon, I sure hope telnet is disabled.

Also from an audit perspective, you want to make sure no one had the ability to use this account. Personal administrative accounts make sure things can be tracked back to specific users in case something happens.

  • 2
    While I do agree with that statement, I would also like to see an argument stating what risks one might get by not disabling the user if it's never used. – efr4k Aug 6 '15 at 12:03
  • Brute force attempts, depending on the GPO's. Also, Microsoft considers this account only to be used as a setup and disaster recovery account. And in case you're wondering if you can use a disabled account during recovery, yes you can! In safe mode, this account can be used. – Jeroen Aug 6 '15 at 12:26
  • Think of it this way... just because the admin account is "never" used doesn't mean that it "can't" be used. (if someone cracks or learns of the password) There are guard rails along highways with dangerous cliffs that have "never" been used. (thank goodness) but they are there none the less. Should they be removed because they are "never" used? Think of disabling the admin account as adding a guard rail alongside a dangerous cliff on the highway. It's a precautionary measure. – k1DBLITZ Aug 10 '15 at 21:01
  • Sometimes you need local admin though. Ive seen a situation in the past where a PC has lost trust with with the domain, all cashed credentials have expired and there is no local admin to access the system. – TheJulyPlot Sep 5 '15 at 12:47
0

Among other reasons to disable this account, by default it has no password! While Windows will (by default) block remote access via passwordless accounts (and has been doing so for a few versions now, though it didn't always do that), a local user would be able to log on as Administrator or use the runas or UAC commands to gain Admin priviliges, even if your normal account is fully locked down.

You can of course set a password for Administrator - either perform a password reset from another Admin account, or log in as Administrator (after enabling it) and use the normal password change process - but by default it doesn't have one. The Windows install process no longer prompts you to set one up.

  • To be fair, enabled or not, it is or at least should be basic procedure to password protect the local admin account. – TheJulyPlot Sep 6 '15 at 8:31
  • Agreed, for sure. It's not protected by default, though (which makes Safe Mode recovery a lot easier, at the risk of having a way to boot to password-free login if you have physical access) and that's probably part of why it's disabled by default. – CBHacking Sep 6 '15 at 9:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.