How to Enable and Disable the Built-in Administrator Account on Windows 11

When Windows is installed on a computer, the user is prompted to create their own account with administrative privileges. At the same time, a built-in Administrator account is automatically created on the computer. This account is disabled by default and in most cases will never be used by the device owner. This guide shows you how to enable and disable the built-in Administrator account on Windows 11.

Contents

Why the Built-in Administrator Account is Disabled by Default

Note that Microsoft disables the built-in Administrator account in Windows by default for security reasons.

UAC (User Account Control) bypass risk

Keep in mind that the built-in Administrator account runs with elevated privileges and does not follow the same UAC restrictions as standard admin accounts. This means many actions are executed without prompts, which significantly increases the risk of accidental system changes/malware execution.

SID 500 privileged identity

The built-in Administrator account is always associated with the well-known SID ending in **-500**, which makes it a predictable target for attackers in brute-force and lateral movement cases. Note that even if renamed, the SID remains the same.

Reduced attack surface principle

When you disable the account by default, you are following Microsoft’s security design principle of minimizing the attack surface. Attackers often target built-in and predictable accounts during credential attacks.

Preference for named administrator accounts

Modern Windows systems encourage the use of individual admin accounts instead of a shared built-in Administrator account. This improves auditing, logging, and accountability in enterprise environments.

Enable and Disable the Built-in Administrator Account on Windows 11

You can check the current status of the built-in Administrator account in Windows using the Local User Management snap-in (lusrmgr.msc).

Expand the Users section and find the Administrator account in the list;
This account is disabled by default;
To enable it, go to the user’s properties and uncheck the Account is disabled box. Save the changes;
After enabling the account, you must set a password. Right-click and select > Set password;
Set a complex password that matches your local Windows password policy settings;

You can also use the command line to view the status of the built-in Administrator:

net user administrator

The account is disabled in this example (Account active: No).

To enable the Administrator account, run the command:

net user administrator /active:yes

Set a password:

net user administrator *

If the built-in administrator account has been renamed, this command will return an error:

The user name could not be found.

Enabling and Disabling Admin Account with PowerShell

In modern Windows versions, you can manage local accounts using PowerShell cmdlets.

In order to enable built-in Administrator account, run the following command:

Enable-LocalUser -Name "Administrator"

You can disable built-in Administrator account with the command:

Disable-LocalUser -Name "Administrator"

We recommend using the cmdlets mentioned above as the modern approach for Windows 10/Windows 11.

However, you can find the current administrator account name by its well-known SID, which always ends in 500. You can identify the built-in Administrator account using PowerShell only. Run the command:

Get-LocalUser | Where-Object { $_.SID -like "*-500" } | Select-Object Name, SID

The built-in Windows Administrator account cannot be deleted (unlike other accounts). You will get an error if you try to delete it:

The following error occurred while attempting to delete the user Administrator:
Cannot perform this operation on built-in accounts.

It is not recommended to leave the Administrator account permanently enabled. After using it, be sure to disable the account. This reduces exposure to brute-force attacks.

net user Administrator /active:no

To increase the security of your computer, you can rename the built-in administrator account. This protects against password brute force attacks. You can rename the account from the lusrmgr console.

Right-click account > Rename;
Specify a new administrator account name;

Note. The LocalAccounts PowerShell module (Enable-LocalUser, Disable-LocalUser, Get-LocalUser) is not available on Active Directory DCs because local accounts do not exist on DCs. To manage the built-in Administrator account on a DC, you should use AD tools/net user command instead.

How to Enable Built-in Administrator Account without Logging Windows 11

The most common use of the built-in Administrator account is when other Windows accounts are disabled or deleted and you cannot log on to the computer.

Important. Note that this is a last-resort recovery method. It modifies the Windows registry offline using WinPE. You should use it only in emergency cases where:

All admin accounts are inaccessible

Normal login methods (Safe Mode, password reset, recovery tools) are not available

You can’t access the system through standard admin channels

Security and compliance considerations

This procedure temporarily bypasses normal Windows authentication mechanisms
It requires physical/hypervisor-level access to the machine
It may be restricted in enterprise environments with BitLocker/Secure Boot enabled
All changes should be reverted immediately after recovery

You can enable the built-in administrator by booting the computer into WinPE. This requires an installation USB stick with Windows or any LiveCD.

Boot your computer from the Windows installation image and press Shift+F10 at the start of the installation;
Type regedit in the command prompt;
In the Registry Editor, select HKLM > File > Load Hive;
Open the file C:\Windows\System32\config\SYSTEM and specify a temporary hive name;
Navigate to HKLM\your_hive_name\Setup;
Modify the following registry parameters:
```
SetupType -> 2
CmdLine -> cmd.exe
```
Note that these registry changes temporarily alter Windows setup behavior to launch a command prompt during boot. This is not a standard config and you should only use it for recovery purposes.
Unload the registry hive, restart the computer and boot to the Windows welcome screen;
A command prompt opens where you can enable the built-in administrator and set a password:
```
net user administrator /active:yes
net user administrator *
```
Run regedit, go to HKEY_LOCAL_MACHINE\SYSTEM\Setup, change the parameters SetupType > 0, CmdLine > empty.
Restart your computer and you will be able to log into Windows using the built-in Administrator credentials.

Note that if the system drive is protected with BitLocker, you must unlock the volume before loading the offline registry hive. Otherwise, the SYSTEM hive cannot be accessed from WinPE.

After regaining access, it is critical to:

Restore original registry values (SetupType = 0, CmdLine = empty)
Re-enable normal boot behavior
Remove any temporary admin bypass configs
Audit local user accounts for unauthorized changes

Alternative Recovery Methods (Recommended First)

Before using WinPE registry modification, you should consider safer alternatives:

Safe Mode with Built-in Administrator

Boot into Safe Mode and check if the Administrator account is available.

Password Reset via Another Admin Account

If another admin account exists, you need to reset access using the following:

Computer Management (compmgmt.msc)
PowerShell Set-LocalUser

Microsoft Account Recovery Options

If the system uses Microsoft accounts, use official recovery mechanisms.

System Restore

Restore the system to a previous working state if restore points are available.

Managing the Built-in Administrator Account with Windows LAPS

Generally, when you are working with enterprise environments, it is not recommended to manually set and manage the built-in Administrator password on individual machines. Windows LAPS (Local Administrator Password Solution) provides centralized management of local admin passwords and automatically rotates them according to the configured policy.

With the help of Windows LAPS is built-in Windows solution and can manage the password of the built-in Administrator account. Depending on the deployment case, password info can be backed up to AD Domain Services/Microsoft Entra ID.

Windows LAPS is particularly useful when an organization needs to manage local admin accounts across many workstations and servers. Instead of assigning the same password to the Administrator account/manually changing passwords with net user, you can config a policy that automatically generates and rotates unique passwords for each device.

For example, in an AD environment, you can configure Windows LAPS through Group Policy. To do this, navigate to Computer Configuration → Policies → Administrative Templates → System → LAPS. Here you can config settings such as:

the managed local admin account;
password complexity and length;
password expiration/rotation period;
the AD backup location;
password encryption and authorized password readers.

For Microsoft Entra joined devices managed by Microsoft Intune, you can config Windows LAPS through Intune rather than Group Policy. You can use an Intune config profile and the Windows LAPS policy settings provided through the Local Policy CSP. This allows you to manage and rotate local admin passwords on Entra joined devices without requiring traditional AD/GPO infrastructure.

In order to check Windows LAPS config and diagnose LAPS-related issues locally, run the following command:

Get-LapsDiagnostics

This cmdlet can help you to identify config/processing problems with Windows LAPS on the local machine.

In an Active Directory environment, authorized admins can retrieve the current LAPS password for a machine with the following command:

Get-LapsADPassword -Identity PC1

Keep in mind that for new enterprise deployments, you should prefer Windows LAPS over manually managing local Administrator passwords/deploying the legacy Microsoft LAPS solution.

What is the built-in Administrator account in Windows 11?

It is a hidden local account created automatically during installation. It has full system privileges and is separate from user-created administrator accounts. By default, it is disabled for security reasons.