loacl administrator

[GrimR]

why is the local admin account disabled?
i know how to get it enabled but what was MS's thought behind this?

 

[smah]

I suspect that it's because most XP users never put a password on it. There are literally millions of XP systems in the world with an Administrator account with no password. In my opinion (and I suspect MS's), this is a huge security risk.

I haven't had a need (oportunity) to test if it actually works, but the disabled Administrator account in Vista is supposed to become active & useable if all other admin user accounts become disabled or corrupted for some reason.

However, personally I alway immediately enable the real Administrator account, set a good password, and hide it from the logon screen.

 

[sggaunt]

smah. Would you do that for a single user machine, or just put up with the Pop ups?

To be honest I don't yet know if running as a 'user' will be a problem yet. My new machine will be dong quite a bit of programming, a pop up every time I edit and run an application might get a bit much.






Steve: N.M.N.F.
Playing the blues isn't about feeling better. It's about making other people feel worse.

 

[GrimR]

sggaunt I think you missing the question, it's the local admin account not UAC [User Account Control]

 

[smah]

I enable it on standalone machines, I don't actually use it as a interactive logon account. Enabling or disabling the Adminstrator account, does not change the UAC behavior of standard accounts. With the Administrator account hidden from the logon screen, there's no way to log on to it anyway, except by Remote Desktop.

I hadn't thought about it before, since I primarily deal with Business & Ultimate, but since the Home editions can't be a RD host, there wouldn't be much value in doing this on the home editions. However, I'd probably still do it simply for the fact that if it's enabled, I'd hope that I could find a way to get to it in the event of a catastrophic problem.

 

[geeve]

you can logon to the local admin account by putting the name of the computer in the logon field and then use a slash to seperate it from the admin:

Logon:computer name\local admin name
password: password

 

[linney]

Built-in Administrator Account Disabled

http://blogs.msdn.com/windowsvistasecurity/archive/2006/08/27/windowsvistasecurity_.aspx

I follow the same path as "smah" insofar as enabling the Built-in Administrator, setting a password, rather than leaving it blank, and then disabling the account again.

 

[wolluf]

smah - just interested - is there easy way to hide account from logon screen in vista? XP's tweakui had this functionality - but there's no tweakui for vista (that I'm aware of). Just googled it - and no doubt if I look I'll find, but....

and what's the advantage of having the admin account enabled?

btw - linney - what's the advantage of putting password on the admin account if its disabled?

and can't you always still use something like bart - or load drive in another machine for 'catastrophic' problems?

 

[smah]

wolluf, it's the same registry key for vista as it is for xp (xp's tweakui simply sets these values). You just have to create it for Vista since it's not there by default

http://www.petri.co.il/hide_a_user_from_the_welcome_screen_in_windows_xp.htm

With the Administrator account enabled, but hidden, I can use that to connect by Remote Desktop to perform any number of admin tasks directly on the local machine.

Yes, you could load the hard drive in another machine to recover data. But if a local user were to damage their account in such a way that it wouldn't load, I'd still be able to remote in with the hidden administrator account & simply create another user account.

 

[linney]

wolluf,

The Administrator Account is that easy to enable that from my point of view it is an unnecessary risk to leave access via a blank password. Even if there are other circumventing procedures to access data, I never had blank passwords in XP, so now I don't in Vista too.

 

[GrimR]

btw smah although I have used that method for the past few years as a script, in 2003 there is also a GPO for that.