Is it fine to rename hidden administrator account to something else?

Is it fine to rename hidden administrator account to something else?

There's no reason you can't. Pretty common practice in enterprises. It's a very minimal impact for security, but bad guys can still ID the account since it has a well known SID

No it is not OK. Don't mess with it and leave it hidden. It's a superuser account and is hidden for security reasons as it runs everything elevated without UAC.

It is a good idea to create a second local Admin account that you can use for troubleshooting if your original account is corrupted, or you forget the password, or something bad happens.

Renaming it has no impact and if UAC is enabled it will still leverages it. Every account including Administrator runs unprivileged until UAC is invoked.

glasskuter said:

No it is not OK. Don't mess with it and leave it hidden. It's a superuser account and is hidden for security reasons as it runs everything elevated without UAC.

It is a good idea to create a second local Admin account that you can use for troubleshooting if your original account is corrupted, or you forget the password, or something bad happens.

Click to expand...

Agreed. That Administrator is hidden for a reason, has more power than the User with Administrative Rights. And it has to be invoked deliberately, is not recommended to keep it active once the need has been accomplished.

The OP asked for opinions. Since it is a security risk to use the hidden administrator account all the time, I gave mine. I'm not saying it can't be done. I'm saying you shouldn't do it. The hidden account is not new. It's been around since XP through the registry and in it's current form since Vista. It's kind of like a MS 'get out of jail free' account and it's purpose is troublehooting. If you want to make your system less secure it's your choice. You own your system so it's up to you what you decide to do with it.

User rights are only assigned to the 'Administrators' group and not the Administrator account so there are no difference in rights assigned between the Administrator account and an user created administrator account.

On home systems it is preferred to create the second user account for admin functions. The built-in administrator account is better suited for a corporate environment as a break glass account and recommended to implement LAPS so it can not be used for lateral movement in a compromise.

Berton said:

That Administrator ... has more power than the User with Administrative Rights

Click to expand...

Sorry but that is incorrect. The Built-in Admin has no more privileges than any other Admin account. Its UAC is off by default but any other Admin can also do that.

I last tested this in Windows 10 Version 1909; the situation has been the same since 2009 and shows no sign of changing.

Try3 said:

About overriding the System 'user'I've just tested [Version 1909] that the Built-in Administrator remains unable to get access to a folder for which only the System 'user' had access permission.

Click to expand...

- I ran this test on a folder on a USB stick because that made it easy to clean up afterwards; I simply reformatted the USB stick.
- I provided a bit more detail about the test in BiA is just an Admin - my post #13 - TenForums


The Built-in Admin exists for one reason & one reason only, to be enabled by Windows to appear on the Safe mode login screen if Windows cannot detect any other Admin account on the computer.
This behaviour is stated in Administrator account status, Safe mode considerations - MSDocs

All the best,
Denis

Why would you bother as it is hidden anyway?

Muz said:

Is it fine to rename hidden administrator account to something else?

Click to expand...

Works fine on Windows server -- so I don't see why it wouldn't work in Windows - certainly pro editions.


You can also change it via registry with "local security policies" etc.

It's probably of more use on a server as it's better to login as an administrator with an idenifiable user named account so proper server audit trails can be monitored correctly rather than using the generic "Administrator" account. In larger workp[laces you'll certainly have more than one person responsiblle for managing and dealing with server issues.

Also being a multi user system you might need more than one person to be logged on concurrently to be resolving issues that require administrative privileges. This requires different accounts of course.

On bog standard windows if you already have admin privileges I'm not sure what it brings to the table.

Cheers
jimbo

Try3 said:

The Built-in Admin has no more privileges than any other Admin account. Its UAC is off by default but any other Admin can also do that.

Click to expand...

But this thread is about whether one should mess with the hidden administrator account which I strongly suggested one does not.

Regarding turning off UAC, yes, you can turn UAC off for an Admin USER account giving it the same priviledges but that level of control can also be dangerous. That level of control is not meant to be used for everyday use, whether one uses the hidden account or turns of UAC for an admin user account. There’s no safety net, so a misstep could royally screw up your system. Any security benefits and risk mitigations that are dependent on UAC aren't present on the computer. One of the risks is malicious software running under elevated credentials without the user being aware of its activity.
So, if ANY user, I don't care how experienced they are, feel they are so good they will never make a mistake and want to turn off UAC, I call hogwash. And if any user thinks he is above getting malware, I again call hogwash. Just my opinion and I'm sticking to it.