Embed Size (px)
DESCRIPTION
How to Enable or Disable the Built-in Elevated Administrator Account in Windows 7
Citation preview
How to Enable or Disable the Built-in Elevated Administrator Account in Windows 7
InformationThis tutorial will show you how to enable or disable the built-in elevated Administrator account inWindows 7.
NoteStandard user (Users) - The standard account is an unelevated restricted users account. It can help protect your computer by preventing users from making changes that affect everyone who uses the computer, such as deleting files that are required for the computer to work. It is recommend to create a standard account for each user instead of an administrator account for the user. When you are logged on to Windows with a standard account, you can do almost anything that you can do with an administrator account, but if a standard user wanted to do something that requires elevated rights that affects other users of the computer, such as installing software or changing security settings, Windows will give the standard user a UAC prompt to enter the password of an administrator account for approval and confirmation before allowing the action.
administrator user - Is an unelevated administrator account that is created by default during the installation of Windows 7, or is already setup or you on a OEM (ex: Dell) computer. An administrator account has complete access to the computer, and can make any desired changes. To help make the computer more secure, this administrator account type will be prompted by UAC by default to give confirmation before allowed to make any changes that require elevated administrator rights. Such as those that affect the system, other users, or when running anything elevated (Run as Administrator) since running elevated will allow it to have access to the entire computer.
Built-in "Administrator" - Is the hidden elevated administrator account that has full unrestricted access rights and permission on the computer. By default, this elevated "Administrator" account is not prompted by UAC by default to provide confirmation before allowed to make any changes that requireelevated administrator permissions since it is an elevated account.
WarningIf you enable the built-in Administrator account, then it is recommended to create a password for better security.
For additional security purposes, it is also not recommended to leave the built-in Administrator account always enabled, or to use it for everyday purposes.
OPTION ONE Enable built-in Administrator in Local Users and GroupsNOTE: This option will only be available in the Windows 7 Professional, Ultimate, and Enterprise editions.1. Open the Local Users and Groups manager.
2. In the left pane, click on the Users folder. (See screenshot below step 3)
3. In the middle pane, right click on Administrator and click on Properties. (See screenshot below)
4. To Enable the Built-in Elevated Administrator AccountA) Uncheck the Account is disabled box. (See screenshot below step 6)
B) Go to step 6.
5. To Disable the Built-in Elevated Administrator AccountNOTE: This is the default setting.A) Check the Account is disabled box. (See screenshot below step 6)
6. Click on OK. (See screenshot below)
7. Close the Local Users and Groups window. (See screenshot below step 3)
8. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)NOTE: Click on the Administrator icon to log on to the built-in Administrator account.
OPTION TWO Enable built-in Administrator in an Elevated Command PromptNOTE: This option can be used in all editions of Windows 7. If your Windows 7 uses another language than English, then you may need totranslate the word administrator part of the commands below to your language to use instead.1. Open an elevated command prompt.
2. To Enable the Hidden Built-in Elevated Administrator AccountA) In the elevated command prompt, copy and paste the command below and press Enter. (See screenshot below)NOTE: If you had previously renamed the built-in "Administrator" account's name,
then you will need to substitute administrator in the command below with the new name instead.net user administrator /active:yes
B) Go to step 4.
3. To Disable the Hidden Built-in Elevated Administrator AccountNOTE: This is the default setting.A) In the elevated command prompt, copy and paste the command below and press Enter. (See screenshot below)NOTE: If you had previously renamed the built-in "Administrator" account's name, then you will need to substitute administrator in the command below with the new name instead.net user administrator /active:no
4. Close the elevated command prompt.
5. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)NOTE: Click on the Administrator icon to log on to the built-in Administrator account.
OPTION THREE Enable built-in Administrator in Local Security PolicyNOTE: This option will only be available in the Windows 7 Professional, Ultimate, and Enterprise editions.1. Open the Local Security Policy editor.
2. In the left pane, expand Local Policies, and click on Security Options. (See screenshot below)
3. In the right pane, right click on Accounts: Administrator account status and click on Properties. (See screenshot above)
4. To Enable the Hidden Built-in Elevated Administrator AccountA) Select (dot) Enabled. (See screenshot below step 6)
B) Go to step 6.
5. To Disable the Hidden Built-in Elevated Administrator AccountNOTE: This is the default setting.A) Select (dot) Disabled. (See screenshot below step 6)
6. Click on OK. (See screenshot below)
7. Close the Local Security Policy window. (See screenshot below step 2)
8. Log off, and you will now see the built-in Administrator account log on icon added (enabled) or removed (disabled) from the log on screen. (See screeenshot below)NOTE: Click on the Administrator icon to log on to the built-in Administrator account.
How to Enable the Built-in Elevated "Administrator" Account from WinRE
Information
Theoretically if you don't have any administrator account, the built-in Administrator account should be available in safe mode (see also related articles). Sometimes due to any identified reason, the built-in Administrator may not to be available in safe mode.
This tutorial will help you to log on to the built-in Administrator in this case in Vista and Windows 7. It may also help if you forgot your admin password and you don't have a password reset disk.
METHOD I (work only for 32 bit systems)
1. Download this file enableadmin.exe, save it on your desktop, and unblock it.
2. Open a command prompt at boot.
3. In the command prompt, type diskpart and press Enter. (see screenshot below step 5)
4. In the command prompt, type list volume and press Enter. (see screenshot below step 5) NOTE: This will let you see what the drive letter is for your Windows 7 drive. It may not always be the C: drive letter at boot.
5. After making note of the drive letter, type exit and press Enter. (see screenshot below)
6. In the command prompt, type:cd /d <boot partition>:\Users\<your account name>\Desktop
press ENTER
where <boot partition> is the drive letter where you installed Windows 7
and next type in command prompt
enableadmin
example:
here OS is on drive D:,the account name was John where this file has been placed so commands for this example will be:
cd /d D:\Users\John\Desktop
press ENTER
enableadmin
press ENTER
7. Restart computer,log on to build-in Administrator account and now you can try to fix problem dependce from situation -fix your account,reset password for your account or create new admin account.
METHOD II (work for all systems)
1. Open a command prompt at boot.
2. In the command prompt, type the command below and press Enter.regedit
3. Click on HKEY_LOCAL_MACHINE (or HKEY_USERS - your choose. In this example I've chosen HKEY_LOCAL_MACHINE) .
4. Go to File menu and choose load hive option
it will open new window and in that navigate to drive where your OS is installed and go to <boot partition>\Windows\System32\config
in this example it is C:\Windows\System32\config
5. Choose SAM file and click Open
6. Next appear Key Name box,type the name whatever you want i.e REM_SAM
7. Go to HKEY_LOCAL_MACHINE\REM_SAM\SAM\Domains\Accounts\Users\000001F4 key and double click on string F,
it will open table with hexadicimal numbers
Build-in Administrator is disabled
8. In this table find 11 number (8th line,first column in table -images),click to the right of it,press backspace and the 11 disappear and insert the 10 in this place
Build-in Administrator is enabled
9. Close box,the whole regedit and restart computer.
10. Log on to build-in Administrator account and now you can try to fix problem dependce from situation -fix your account,reset password for your account or create new admin account.
Warning
When finished repair you should disable build-in Administrator account (eventually create password for it).This account shouldn't be used in daily work.
