What is an administrator account?
An administrator account has full control of the computer. Because it is a member of the local Administrators group, it can install and remove software and drivers, create and delete user accounts, change security settings, take ownership of any file and read or change other users' data. The first account created during Windows setup is an administrator. When a PC joins a domain, the Domain Admins group is added to its local Administrators group, so domain administrators have the same power on every member computer.
Two kinds of administrator
- Named administrator accounts: any account you create or promote to Administrator, such as the account made at setup. These run under UAC Admin Approval Mode: programs start with standard rights, and a consent prompt (Yes or No) appears when something needs full rights.
- The built-in Administrator account: an account that exists on every Windows installation and is disabled by default. By default it is not subject to Admin Approval Mode, so everything it runs is elevated without prompts. That makes it useful for recovery and risky for daily use. Enable it only when needed with
net user administrator /active:yesfrom an elevated prompt, give it a strong password, and disable it again withnet user administrator /active:no.
Admin Approval Mode and Run as administrator
When an administrator signs in, Windows creates two access tokens: a filtered standard token used for normal work and a full token used only after approval. That split is why an admin still sees UAC prompts and why some tasks fail unless you elevate on purpose. Ways to elevate:
- Right-click an app or shortcut and choose Run as administrator.
- Type the app name in Start search and press Ctrl+Shift+Enter.
- Choose Terminal (Admin) from the Win+X menu.
- Set a shortcut to always elevate in its Properties > Shortcut > Advanced.
An elevated console shows "Administrator:" in its title bar. If sfc /scannow replies that you must be an administrator, the window was not elevated, even though the account is an admin. The same applies to chkdsk /f, diskpart and most net user changes.
Security best practices
- Use a standard account for daily work and a separate administrator account for maintenance. Technicians in organizations typically have both.
- Keep the built-in Administrator disabled. If it must be used, rename it and give it a strong, unique password.
- Change default passwords on every device and app that ships with an admin login, such as routers, printers and IoT devices.
- Keep the Administrators group small and review it with
net localgroup administrators. - Do not drop the UAC slider to "Never notify" to stop prompts; that removes a protection layer.
- In domains, Windows LAPS can give each PC's local admin account a unique password that rotates automatically, so one leaked password does not open every machine.
Recognizing admin problems
- Every user is an admin and unwanted software keeps appearing: remove unneeded members of the Administrators group.
- A user forgot an admin password: another administrator can reset a local account's password in Settings,
lusrmgr.mscor withnet user username *. If no other admin exists, recovery becomes much harder, so document a second admin account. - A setting is grayed out with a note that your organization manages it: Group Policy or MDM controls it; admin rights on the PC will not override it.
Administrator account on the CompTIA A+ exam
Administrator accounts fall under Core 2 (220-1202) objective 2.2 (Windows users, groups and permissions) and objective 2.7 (workstation hardening). Know that the built-in Administrator is disabled by default, that default passwords must be changed, that admins still get UAC consent prompts, and that Run as administrator is needed for tools such as sfc, chkdsk /f and diskpart. When a question asks for the most secure way to give someone admin access, a separate admin account used only when needed beats making the daily account an administrator.