7

In Windows 2008 (and R2) should I rename the Administrator account or disable it and create a new one?

Will disabling the built-in Administrator account cause any problems, is this still considered best practice?

5 Answers 5

2

Common practice is to just rename the account.

4
  • 1
    Renaming changes the logon attributes from the installation defaults, but does not actually change the intrinsic security properties of the account (e.g. un-exposed attributes), that is why renaming is more preferable as well as safer than deleting and recreating. So Johnnie Odom's statement of "Renaming it basically turns it into another account for purposes of security." is not technically correct, but his overall position is.
    – user48838
    Sep 11, 2010 at 22:08
  • To clarify my answer -- I didn't mean that renaming changes the security features from a systems standpoint, but from the perspective of a security mindset -- i.e. that renaming eliminates a comment attack vector. My note that the account has already been "configure nicely" indicates that the account's nature does not change. Sep 12, 2010 at 2:08
  • Just pointing out a confusing, maybe misleading statement. The approach is sound and it was acknowledged.
    – user48838
    Sep 12, 2010 at 8:46
  • 1
    @johnnie @user48838 - My concern was that the administrator account always used the same SID and that this could be used as part of an attack to compromise a machine rather than using the account name. I'm aware that local admin SID's always start with S-1-5- and end with -500 but the three remaining parts of the SID are large enough values and random enough that I'm happy to rename and sleep comfortably at night.
    – Kev
    Sep 12, 2010 at 10:23
12

Microsoft Best Practices found on TechNet and MS Press' "Securing Windows Server 2008 R2"

 1. Don't rename it.

You'll waste your effort and (for backward compatibility) if you have any apps/services on your network that require the Admin account to function, they will break.

 2. Disable the BUILTIN\Administrator.

Renaming the account to create a honey pot for attackers is an outdated practice. Any cracker good enough to get this far into your network knows this ploy already. The cracker will just look for the SID ending in -500.

 3. Create an account with a non-descript name and give it admin rights.

That is, name the account "JohnBlack" or "BettyClark". Do not name the account something like Superman, Root, Skywalker, or anything with Admin or ADM in it like testadm or LocalAdmin. Programs that still look for the Admin account by name have evolved enough to check for these names too.

 4. After you've created the account in step 3, NEVER USE IT!

You can't audit Admin access, if you're using it as a regular account (aside from all the other reasons not to use it).

1
  • just disable it and use cached credentials if domain connectivity goes south.
    – tony roth
    Jun 1, 2012 at 18:02
2

Renaming the account is the best bet because you are going to require some sort of local admin account, and the one that ships has already been set up and configured nicely to run the system. Renaming it basically turns it into another account for purposes of security.

9
  • -1 for not technically accurate--see user48838's comment for more details. Sep 12, 2010 at 1:43
  • See my comment to user48838's comment. Sep 12, 2010 at 2:05
  • 2
    It changes the name, but not the SID, so I'm not sure it's a real win. The alternative is to rename the administrator account and disable it, then rename the guest account to "Administrator". Sep 12, 2010 at 3:53
  • Some folks like Steven Sudit's approach to catch "stupid wanabes..." It creates a mini "honey pot" which may lead to idiots who think they are "hacking away" at something meaningful.
    – user48838
    Sep 12, 2010 at 8:41
  • @Steven - as I said above, I'm aware that local admin SID's always start with S-1-5- and end with -500 but the three remaining parts of the SID are large enough values and random enough that I'm happy to rename and sleep comfortably at night.
    – Kev
    Sep 12, 2010 at 10:26
0

I've come across both recommendations. In my last job we disabled local admin accounts on machines that were on the Active Directory domain.

I'd personally recommend disabling it and creating a new administrative user account. That way if there are any problems with the user profile you still have an administrative account you can fall back on.

5
  • 1
    Assuming you can get back in to re-enable it...
    – user48838
    Sep 12, 2010 at 8:42
  • 1
    Very true, but there are free boot disk type tools you can use to re-enable it. Sep 12, 2010 at 18:24
  • Wouldn't that get you back into the possibly faulty "administrator" account or the one that has been disabled???
    – user48838
    Sep 12, 2010 at 22:44
  • The tool I'm most familiar with thought not free (Passware's Windows Key Pro) will let you choose any account on the systems to enable and reset the password. There are a number of free apps out there with similar functionality. Sep 13, 2010 at 3:02
  • msdart will hack the password just fine. just disable and cache the credentials.
    – tony roth
    Jun 1, 2012 at 19:46
0

williamtorres answer seems like the correct one. Given that here is the command to disable the administrator account (so you don't have to look it up :)

net user administrator /active:no

http://technet.microsoft.com/en-us/library/dd744293(v=ws.10).aspx

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .