Convert Builtin Administrator account to standard without losing data?

[bamboozile]

Hello,

Much like the title, I wanted to know if it's possible to convert the Built-in Administrator account into a standard user account with out copying over/losing data. I want to stop using the Built-in Administrator as it poses a security threat but I already have all my files/programs moved in.



Initially, I tried to rename the account to a different name, then created a secondary normal local admin account and went into the Group Policy Editor to remove the Built-in Administrator from the Administrator circle, but receive an error as expected. Something to the effect of, " Unable to remove Administrator from Built-in Administrators group". According to this page you can disable the account but not remove it, but won't that lose/hide all my data as well on that account? Is there any way around this without backing up/coping everything?



Thanks in advance

 

[LMiller7]

You can't change any of the built in accounts to another type. You can freely disable the account without losing any of the profiles contents.

 

[bamboozile]

You can't change any of the built in accounts to another type. You can freely disable the account without losing any of the profiles contents.

Thanks for reply. After disabling the account though, it won't be accessible, correct? In other words, I won't be able to log into it at startup? So the data along with account will be safe, but hidden.

If the data is hidden/inaccessible that is a problem, I need the data transferred (1:1 copy w/ all programs, docs) to a standard account so it can be used. Do you know the smoothest way of going about this?

Thanks again

 

[LMiller7]

Disabling an account only prevents you from logging in with it. All data associated with the administrator account can be accessed by any other admin level account.

 

[bamboozile]

Disabling an account only prevents you from logging in with it. All data associated with the administrator account can be accessed by any other admin level account.

Using this logic, I should be able to see all the documents/programs from the Built-in Administrator account on the secondary admin account I already created, but I can't. The secondary admin account creates a whole new desktop and all the other data isn't readily available just as it was on the built-in admin account. Like I said, I'm trying to make a 1:1 copy so that when you log in all data/desktop shortcuts/programs are just you left it on the built-in admin account.

Do I need to disable the built-in administrator account first before all the info becomes readily available on the secondary admin account like you describe?

I'm sorry if these are basic questions but this is an employee machine and if data is misplaced or their work becomes difficult because of tech glitch it will be my head. Thanks again

 

[Alejandro85]

As a middle point, you might want to change the default option and make the built-in administrator subject to UAC as any other account is, so that at least you get that tiny bit of security. Look for the details here:
UAC - Enable or Disable for Built-in Administrator Account

Anyway, the best method is just create a new standard account and move your files there. The admin account can do this quite easily. Then use UAC to elevate when needed. That brings some real level of security by cutting permissions when they're not actually used.

Disabling an account only prevents you from logging in with it. All data associated with the administrator account can be accessed by any other admin level account.

Using this logic, I should be able to see all the documents/programs from the Built-in Administrator account on the secondary admin account I already created, but I can't. The secondary admin account creates a whole new desktop and all the other data isn't readily available just as it was on the built-in admin account. Like I said, I'm trying to make a 1:1 copy so that when you log in all data/desktop shortcuts/programs are just you left it on the built-in admin account.

It is, actually. Administrators can do anything and have access to everything (that's why they're admins ). Obviously each user gets its own desktop and its own set of configurations, but the files are totally accessible just by looking at each one profile under the c:\users\<username> folder. All custom desktop icons, documents, settings and everything is there, and admins have full power to read and copy those.

 

[paul1149]

Use MigWiz to export all account data and settings, then import it back to a new account.