Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I know some folks out there recommend not to rename the built-in administrator in Windows Server 2003. Instead, create another admin account with the same privileges and disable the built-in administrator account. But what if the situation is that I need to rename the administrator account? What would be the best procedure to do this without affecting my Exchange Server 2007, Other Member File Servers and Blackberry Enterprise Server? We've been using the administrator account to login to our windows servers as well as the other servers we have. What would be the step by step approach I need to do to ensure that the moment the administrator's name is renamed, my remaining servers will not crash. For sure there are certain situations where some software's installed as a service in windows would be affected and perhaps after the administrator name has been renamed, I probably need to go into each services on every windows server I have and start editing any software service that uses the administrator name when logging in before restarting each server? I appreciate everyone's advice. Thank you.

share|improve this question
up vote 5 down vote accepted

Group Policy.

Open Group Policy Management, and the setting is found at Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

It's named Accounts: Rename administrator account. (At least at a 2008 R2 FL. The option exists on a 2003 domain, but might be named slightly differently, but I don't recall off the top of my head.)

I can't think of any reason to not rename it on the Exchange server, but you can always create an OU that excludes Group Policy Inheritance and put the Exchange server in there, or use WMI filtering on the Group Policy to specifically exclude the Exchange server.

As far as installed software and services running as the Administrator account, that's both very bad, and not a default behavior on anything I'm familiar with. So, hopefully, you're worrying about nothing... and if not, it might be worth breaking that just so you can find and correct services running as the Administrator - create and use service accounts instead.

enter image description here

share|improve this answer
    
Thanks for the insight HopelessN00b. On GPO, will it rename the domain administrator account? Or it will only rename the local administrator account on each server? – GeePee Jan 17 '14 at 3:02
    
@GeePee It depends, basically, on whether the domain controllers have the group policy applied to them (provided they're 2003 or above). So, unless you're stuck with a 2000 or lower domain, you can choose whether or not this applies to the domain admin account by controlling if it applies to DCs or not. You can change the domain admin account separately from the local admin account (which is a good idea), either via GPO or manually. If all you're worried about is the domain admin, doing it manually is easier than setting up a GPO. – HopelessN00b Jan 17 '14 at 10:05

Nothing you've described will crash. Internally, Windows uses the SID, not the display name. That name is just there to be human-readable and friendly.

share|improve this answer
    
Hi MDMarra. Do you mean all I need to do is just simply go to Active Directory Users and Computers, find the built-in Administrator user object and just simply right click and rename it? If so, what would be my next steps after doing that? Proceed on the rest of the server farm and look into each windows service and rename all login entries to the new administrator name before restarting each member server? – GeePee Jan 17 '14 at 1:02
    
Are you talking about your domain administrator account or the local administrator account on each server? They're two different things. – MDMarra Jan 17 '14 at 2:45
    
It's the domain administrator account. When we log into any of our member servers, whether it's Exchange, Blackberry Enterprise Server..etc, we always use the domain administrator account. – GeePee Jan 17 '14 at 3:01
1  
@GeePee Honestly, the easiest way would be to just right click and rename the account in ADUC (Active Directory Users and Computers). Of course, the services using this account will break after the next reboot or service restart. Unfortunately, there's no way around that, except through it. You need to collect an inventory of the services and applications relying on using that account and reconfigure them. So, before renaming the domain admin, I would inventory these services and apps, create service accounts, and configure the services and apps to use the service account. Then rename. – HopelessN00b Jan 17 '14 at 11:52
1  
If your "external IT audit firm" is recommending that you rename the built-in domain Administrator account but isn't "shitting gold bricks" that you're running a bunch of services as that account then, respectfully, I think your "external IT audit firm" needs to be fired and you need to get a real auditor ASAP. – Evan Anderson Jan 18 '14 at 5:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.