Enable or Disable Elevated Administrator account in Windows 10  

How to Enable or Disable Built-in Elevated Administrator Account in Windows 10

This tutorial will show you how to enable or disable the hidden built-in elevated Administrator account in Windows 10.

You must be signed in as an administrator to be able to do the steps in this tutorial.

User Accounts in Windows 10:

standard user (Users) – The standard account is an unelevated restricted user account that can be a local account or Microsoft account. It can help protect your computer by preventing users from making changes to the system that affects everyone who uses the computer. When you are signed in to Windows with a standard account, you can do almost anything that you can do with an administrator account, but if a standard user tries to do something that requires elevated rights (ex: run as administrator), Windows will display a UAC prompt for the standard user to enter the password of an administrator account for approval and confirmation before allowing the action.

administrator user – Is an unelevated administrator account that is created by default during the installation of Windows, or is already setup for you on an OEM (ex: Dell) computer. This account can be a local account or Microsoft account. An administrator account has complete access to the computer, and can make any desired changes. If an administrator user tries to do something that requires elevated rights (ex: run as administrator), Windows will display a UAC prompt for the administrator user to approve before allowing the action.

Built-in "Administrator" – The hidden built-in elevated "Administrator account" is a local account that has full unrestricted access rights to the PC. By default, this "Administrator" account will not be prompted by UAC. Anything that runs while signed in to this "Administrator" account will also have full unrestricted access to the PC, so it is not recommended to use the built-in "Administrator" account for everyday usage. It’s recommended to only enable and use the built-in "Administrator" account as needed instead.

 CONTENTS:

  • Option One: Enable or Disable Built-in Administrator in Elevated Command Prompt
  • Option Two: Enable or Disable Built-in Administrator in Elevated PowerShell
  • Option Three: Enable or Disable Built-in Administrator in Local Users and Groups
  • Option Four: Enable or Disable Built-in Administrator in Local Security Policy
  • Option Five: Enable or Disable Built-in Administrator in Command Prompt at Boot

EXAMPLE: Administrator enabled on Sign in and Switch User

OPTION ONE

Enable or Disable Built-in Administrator in Elevated Command Prompt

1. Open an elevated command prompt.

2. Do step 3 (enable), step 4 (enable with password), or step 5 (disable) below for what you would like to do.

 3. To Enable the Built-in Elevated "Administrator" Account
A) In the elevated command prompt, copy and paste the command below, press Enter, and go to step 6 below. (see screenshot below)

net user Administrator /active:yes

If you had previously renamed the built-in "Administrator" account’s name, then you will need to substitute Administrator in the command below with the new name instead.

If your Windows uses a different language than English, then you would need to substitute Administrator in the command below with the translation for your language instead.


 4. To Enable the Built-in Elevated "Administrator" Account with Password
A) In the elevated command prompt, copy and paste the command below, press Enter, and go to step 6 below. (see screenshot below)

net user Administrator password /active:yes

Substitute password in the command above with the actual password you want to use to sign in to the built-in Administrator account with.

If you had previously renamed the built-in "Administrator" account’s name, then you will need to substitute Administrator in the command below with the new name instead.

If your Windows uses a different language than English, then you would need to substitute Administrator in the command below with the translation for your language instead.

 5. To Disable the Built-in Elevated "Administrator" Account
This is the default setting.
A) In the elevated command prompt, copy and paste the command below, press Enter, and go to step 6 below. (see screenshot below)

net user Administrator /active:no

If you had previously renamed the built-in "Administrator" account’s name, then you will need to substitute Administrator in the command below with the new name instead.

If your Windows uses a different language than English, then you would need to substitute Administrator in the command below with the translation for your language instead.


6. When finished, you can close the elevated command prompt if you like.

OPTION TWO

Enable or Disable Built-in Administrator in Elevated PowerShell

1. Open an elevated PowerShell.

2. Do step 3 (enable) or step 4 (disable) below for what you would like to do.

 3. To Enable the Built-in Elevated "Administrator" Account
A) In the elevated command prompt, copy and paste the command below, press Enter, and go to step 5 below. (see screenshot below)

Enable-LocalUser -Name "Administrator"

If your Windows uses a different language than English, then you would need to substitute Administrator in the command below with the translation for your language instead.

 4. To Disable the Built-in Elevated "Administrator" Account
This is the default setting.
A) In the elevated command prompt, copy and paste the command below, press Enter, and go to step 5 below. (see screenshot below)

Disable-LocalUser -Name "Administrator"

If your Windows uses a different language than English, then you would need to substitute Administrator in the command below with the translation for your language instead.


5. When finished, you can close the elevated PowerShell if you like.

OPTION THREE

Enable or Disable Built-in Administrator in Local Users and Groups

The Local Users and Groups is only available in the Windows 10 Pro, Enterprise, and Education editions.
1. Press the Windows + R keys to open the Run dialog, type lusrmgr.msc, and click/tap on OK.

2. In the left pane, click/tap on the Users folder, then in the middle pane, double click/tap on Administrator. (see sceenshot below)

3. Do step 4 (enable) or step 5 (disable) below for what you would like to do.

 4. To Enable the Built-in Elevated "Administrator" Account
A) Uncheck the Account is disabled box, click/tap on OK, and go to step 6 below. (see screenshot below step 6)

 5. To Disable the Built-in Elevated "Administrator" Account
A) Check the Account is disabled box, click/tap on OK, and go to step 6 below. (see screenshot below step 6)
6. You can now close Local Users and Groups if you like.

OPTION FOUR

Enable or Disable Built-in Administrator in Local Security Policy

The Local Security Policy is only available in the Windows 10 Pro, Enterprise, and Education editions.

All editions can use Option Six below.
1. Press the Windows + R keys to open the Run dialog, type secpol.msc, and click/tap on OK.

2. In the left pane, click/tap on the Local Policies folder to expand it, and click/tap on the Security Options folder. (see screenshot below)

3. In the right pane of Security Options, double click/tap on Accounts: Administrator account status. (see screenshot above)

4. Do step 5 or 6 below for what you would like to do.

 5. To Enable the Built-in Elevated "Administrator" Account
A) Select (dot) Enabled, click/tap on OK, and go to step 7 below. (see screenshot below step 7)
 6. To Disable the Built-in Elevated "Administrator" Account
A) Select (dot) Disabled, click/tap on OK, and go to step 7 below. (see screenshot below step 7)
7. You can now close Local Security Policy if you like.

OPTION FIVE

Enable or Disable Built-in Administrator in Command Prompt at Boot

This option is good for when you are unable to sign in to Windows 10.
1. Boot from your Windows 10 installation USB or recovery drive, and open a command prompt at boot (Shift+F10).

If you don’t have a Windows 10 installation USB or recovery drive, then you can use OPTION SIX here to boot to Advanced Startup like in the screenshot below.

Afterwards, continue to boot to a command prompt at boot.

2. In the command prompt, type regedit, and press Enter. (see screenshot below step 3)

3. In the left pane of Registry Editor, click/tap on the HKEY_LOCAL_MACHINE key. (see screenshot below)

4. Click/tap on File (menu bar), and on Load Hive. (see screenshot below)

5. In the Load Hive dialog, open the drive (ex: D ) that you have Windows 10 installed on, and browse to the location below. (see screenshot below)

The drive letter (ex: C) will not always be the same at boot as it is from within Windows 10.
D:WindowsSystem32config


6. Select the SAM file, and click/tap on Open. (see screenshot below)

7. In the Load Hive dialog, type REM_SAM, and click/tap on OK. (see screenshot below)

8. In the left pane of Registry Editor, navigate to and open the key below. (see screenshot below)

HKEY_LOCAL_MACHINEREM_SAMSAMDomainsAccountUsers00001F4


9. In the right pane of the 000001F4 key, double click/tap on the F binary value to modify it. (see screenshot above)

10 Do step 11 (Enable) or step 12 (disable) below for what you would like to do.

 11. To Enable the Built-in Elevated Administrator Account
A) In the first column of line 0038, change 11 to 10, click/tap on OK, and go to step 13 below. (see screenshot below)

You would do this by clicking to the left of 11 to place the cursor there, press the Delete key, then type 10.

 12. To Disable the Built-in Elevated Administrator Account
A) In the first column of line 0038, change 10 to 11, click/tap on OK, and go to step 13 below. (see screenshot below)

You would do this by clicking to the left of 10 to place the cursor there, press the Delete key, then type 11.

13. Close Registry Editor and the command prompt. (see screenshot below step 3)

14. Click/tap on Continue to startup back in Windows 10. (see screenshot below)

That’s it,
Shawn

Leave a Reply