Built-in Administrator Account - Enable or Disable

How to Enable or Disable the Built-in Elevated Administrator Account in Windows 7​

   Information

This tutorial will show you how to enable or disable the built-in elevated Administrator account in Windows 7.

You must be logged in as an administrator to be able to do the options in this tutorial.

   Note

Standard user (Users) - The standard account is an unelevated restricted users account. It can help protect your computer by preventing users from making changes that affect everyone who uses the computer, such as deleting files that are required for the computer to work. It is recommend to create a standard account for each user instead of an administrator account for the user. When you are logged on to Windows with a standard account, you can do almost anything that you can do with an administrator account, but if a standard user wanted to do something that requires elevated rights that affects other users of the computer, such as installing software or changing security settings, Windows will give the standard user a UAC prompt to enter the password of an administrator account for approval and confirmation before allowing the action.

administrator user - Is an unelevated administrator account that is created by default during the installation of Windows 7, or is already setup or you on a OEM (ex: Dell) computer. An administrator account has complete access to the computer, and can make any desired changes. To help make the computer more secure, this administrator account type will be prompted by UAC by default to give confirmation before allowed to make any changes that require elevated administrator rights. Such as those that affect the system, other users, or when running anything elevated (Run as Administrator) since running elevated will allow it to have access to the entire computer.

Built-in "Administrator" - Is the hidden elevated administrator account that has full unrestricted access rights and permission on the computer. By default, this elevated "Administrator" account is not prompted by UAC by default to provide confirmation before allowed to make any changes that require elevated administrator permissions since it is an elevated account.

   Warning

If you enable the built-in Administrator account, then it is recommended to create a password for better security.

For additional security purposes, it is also not recommended to leave the built-in Administrator account always enabled, or to use it for everyday purposes.

:note: For the updated Windows 10 tutorial, please see here: Administrator account - Enable or Disable in Windows 10 - Windows 10 User Accounts Tutorials

OPTION ONE

Enable built-in Administrator in Local Users and Groups

NOTE: This option will only be available in the Windows 7 Professional, Ultimate, and Enterprise editions.
1. Open the Local Users and Groups manager.

2. In the left pane, click on the Users folder. (See screenshot below step 3)

3. In the middle pane, right click on Administrator and click on Properties. (See screenshot below)

4. To Enable the Built-in Elevated Administrator Account
A) Uncheck the Account is disabled box. (See screenshot below step 6)

B) Go to step 6.
5. To Disable the Built-in Elevated Administrator Account
NOTE: This is the default setting.
A) Check the Account is disabled box. (See screenshot below step 6)
6. Click on OK. (See screenshot below)

7. Close the Local Users and Groups window. (See screenshot below step 3)

8. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)
NOTE: Click on the Administrator icon to log on to the built-in Administrator account.

OPTION TWO

Enable built-in Administrator in an Elevated Command Prompt

NOTE: This option can be used in all editions of Windows 7. If your Windows 7 uses another language than English, then you may need to translate the word administrator part of the commands below to your language to use instead.
1. Open an elevated command prompt, and do step 2, 3, or 4 below for what you want to do.

2. To Enable the Hidden Built-in Elevated Administrator Account
A) In the elevated command prompt, copy and paste the command below and press Enter, and go to step 5 below. (See screenshot below)
NOTE: If you had previously renamed the built-in "Administrator" account's name, then you will need to substitute administrator in the command below with the new name instead.
net user administrator /active:yes


3. To Enable the Hidden Built-in Elevated Administrator Account with Password
A) In the elevated command prompt, copy and paste the command below and press Enter, and go to step 5 below. (See screenshot below)
NOTE: If you had previously renamed the built-in "Administrator" account's name, then you will need to substitute administrator in the command below with the new name instead.
net user administrator password /active:yes

   Note

Substitute password in the command above with the password you want to use to log on to the built-in Administrator account.

4. To Disable the Hidden Built-in Elevated Administrator Account
NOTE: This is the default setting.
A) In the elevated command prompt, copy and paste the command below and press Enter, and go to step 5 below. (See screenshot below)
NOTE: If you had previously renamed the built-in "Administrator" account's name, then you will need to substitute administrator in the command below with the new name instead.
net user administrator /active:no


5. Close the elevated command prompt.

6. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)
NOTE: Click on the Administrator icon to log on to the built-in Administrator account.

OPTION THREE

Enable built-in Administrator in Local Security Policy

NOTE: This option will only be available in the Windows 7 Professional, Ultimate, and Enterprise editions.
1. Open the Local Security Policy editor.

2. In the left pane, expand Local Policies, and click on Security Options. (See screenshot below)

3. In the right pane, right click on Accounts: Administrator account status and click on Properties. (See screenshot above)

4. To Enable the Hidden Built-in Elevated Administrator Account
A) Select (dot) Enabled. (See screenshot below step 6)

B) Go to step 6.
5. To Disable the Hidden Built-in Elevated Administrator Account
NOTE: This is the default setting.
A) Select (dot) Disabled. (See screenshot below step 6)
6. Click on OK. (See screenshot below)

7. Close the Local Security Policy window. (See screenshot below step 2)

8. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)
NOTE: Click on the Administrator icon to log on to the built-in Administrator account.

OPTION FOUR

Enable built-in Administrator from System Recovery (WinRE) at Boot

1. For how, see: How to Enable the Built-in Administrator Account from WinRE
That's it,
Shawn

Related Tutorials

---

• How to Rename the Windows 7 Built-in Administrator Account
• How to Elevate All Administrator Accounts UAC Privilege Level
• How to Create a User Account in Windows 7
• How to Delete a User Account in Windows 7
• How to Create a Password for a Windows 7 User Account
• How to Turn the Guest Account On or Off in Windows 7
• How to Enable the Built-in Administrator Account from WinRE
• How to Change a User Account Type in Windows 7
• How to Enable or Disable a User Account in Windows 7
• How to Enable the Built-in Administrator Account in Windows XP Mode
• How to Reset User Profile of Built-in Administrator Account to Default in Windows
• Enable or Disable User Account Control (UAC) Prompt for Built-in Administrator in Windows

 

[emptysorrows]

Would there be any way of editing the SAM file to do this or create user accounts, or does the SAM just maintain passwords.

 

[Brink]

Hello Emptysorrows,

I'm not sure if there is, but I wouldn't recommend to mess with it. Are you not able to use the normal method to do so?

 

[emptysorrows]

I was previously locked out of my account so I could not. But I edited my SAM file to reset the password so I've already enabled the Admin account. Oh and thanks for the post.

 

[Brink]

That's great news. I'm happy to hear that you got it sorted.

 

[karlsnooks]

Use System Repair disc to enable/disable ?

I have a case where it appears that the user has locked himself out.

UAC shows him as an administrator, but he can not carry out any admin tasks and can not make any changes in UAC.

He can see UAC but can not use UAC.

My question is:
If he boots from a system repair disc,
can he then run:
net user administrator /active:yes

to enable the built-in adminstrator account and then be able to create a new admin account which hopefully he will then be able to use.

This appears to be an honest user and he has shown me snippets verifying the problem on his home computer with home premium installed.

 

[Brink]

Hello Karl,

Yes, he should be able to using this instead though.

http://www.sevenforums.com/tutorials/102552-built-administrator-enable-winre.html

 

[karlsnooks]

that tutorial talks of using a 3rd party program that is only for 32bit systems or did I miss something.

 

[Brink]

For Method 1 yes, but he should be able to use Method 2 to be able to enable it at boot.

 

[karlsnooks]

I'll give it a try, probably Friday. Must make full system image backup first in case disaster strikes. Don't really like that kind of registry editing. looks like a good place for a .reg file perhaps.

 

[Brink]

I'm not sure if a REG file would run at boot like that.

 

[engryasir]

dear!

my administrator account is disabled n i dont have standard account only i have guest account. and i m using my pC from this guest account and i want to acitvate and enable administrator account. please tell me the method n procedure

 

[Brink]

Hello Engryasir, and welcome to Seven Forums.

You may be able to using OPTION FOUR.

Since your only administrator account is disabled, then you may also be able to boot into Safe Mode to enable the built-in Administrator account.

Hope this helps,
Shawn

 

[Faceofjoe421]

Hi Brink, I want to completely takeover and use the Admin account for my actual personal account and personal use:

For example, it will be the only account, have my files, and have my username "Joe", but is it recommended to do so?

 

[Brink]

Hello Joe,

You could, but it's not recommended to always use your built-in Administrator account. The reason why is that the built-in Administrator account has full unrestricted access to the computer. This also means that everything that runs while logged on to the built-in Administrator account will also have full unrestricted access to the computer. This would also include malware.

Using a normal administrator user account, you may at least get a UAC prompt (if left on) to approve or deny anything to run as administrator have full access before it does.

 

[Faceofjoe421]

Is it possible to enable UAC for Admin account?

 

[Brink]

You might as well just use the other normal administrator user account instead then since that's basically what it is.

 

[Yodrak]

Newbie here, and I must be missing something.

At the beginning of the tutorial is a Note that says:
By default, the built-in administrator account is named Administrator, and is disabled.

I've recently installed Windows 7 for the first time and I've added User accounts for myself and my wife as well as enabling the Guest account. Every time that Windows starts it automagically opens the Administrator account - so that Administrator account cannot, by default, be disabled? I will have to make sure that at least one of my User accounts has administrator priviledges before I disable the Administrator account?

Thanks.

 

[Brink]

Hello Yodrak, and welcome to Seven Forums.

Is your Windows 7 a preinstalled version on a store bought computer? If so, the OEM may have had it enabled for their brand and model of computers.

The user account that you setup during the installation of a retail Windows 7 is an administrator account, but it is not the actual built-in "Administrator" account. Is your user account name "Administrator", and not just a member of the administrators group?

If it is the actual built-in "Administrator" account, then yes you will need to make sure that you have a user account that is an administrator type of account before disabling the built-in "Administrator" account.


Hope this helps,
Shawn

 

[Yodrak]

Shawn,

Thanks for the welcome.

My Windows 7 is not a pre-installed OEM version. It was bought 'stand-alone' to install on my Mac, running under Parallels 6, so that I can use a few software programs (not games) that do not have decent Mac versions (e.g. Quicken) or that have no Mac versions at all (some NOLO things).

I did not initially set up any user account when installing windows, it was just there when Windows started after installing. It is named Administrator, and I do not believe that is has a password (because I do not have to enter any password when Windows starts). Subsequent to the first few startups, during which I did things like change the background picture, turn on the Guest user account, and turn on a screen saver, I set up two new standard user accounts - one with my name and one with my wife's name. My user account has a password, my wife's does not (but she has her own Dell PC, also with Windows 7 Home Premium, and almost never uses mine.)

My wife's PC, by the way, has a log-in screen that shows user icons and names from which to select - no automatic log in to an Administrator account. That's the way I would like mine to work - keep everything the same so I don't have to remember too many different things!

From reading the previous posts in this thread, I should probably leave my and my wife's 'every day' accounts as standard accounts, and keep the Administrator account as it is because I will need it from time to time to make changes? But maybe give it a password?

Thanks

 

[Brink]

Yodrak,

Continued here: http://www.sevenforums.com/tutorials/61650-log-user-name-password-4.html#post1722286