Built-in Administrator and Guest¶
Every Windows install creates two accounts, and attackers know them by name.
Administrator has full control and a well-known identity. Password-guessing tools try it first.
Guest lets someone log in with no password. It's disabled by default; an image may have enabled it.
Windows identifies accounts by SID, not name. The built-in Administrator's SID always ends in -500 and Guest's in -501, so renaming doesn't hide them from someone already on the machine. It does defeat remote scripts that try the name Administrator.
Find them by SID¶
Get-LocalUser | Where { $_.SID -like "*-500" -or $_.SID -like "*-501" } | Select Name, Enabled, SID
This catches them even if they've been renamed.
Guest¶
Disable it (CIS 2.3.1.1). Rename it too (2.3.1.4).
net user Guest /active:no
PowerShell to rename:
Rename-LocalUser -Name Guest -NewName visitor
lusrmgr.msc → Users → right-click Guest → Properties → tick Account is disabled. Right-click → Rename.
Administrator¶
Three steps, in this order (renaming is CIS 2.3.1.3):
- Give it a strong password. Even if you disable it, a blank or weak password on this account is a problem if anything ever re-enables it.
- Rename it.
- Disable it, unless the README says something uses it.
net user Administrator Str0ng!Adm1nP@ss
Rename-LocalUser -Name Administrator -NewName sysowner
Disable-LocalUser -Name sysowner
Warning
Make sure another account is in the Administrators group before disabling this one. If it's the only administrator, you'll lock yourself out of administrative work.
Example¶
Get-LocalUser shows Guest enabled and Administrator enabled with PasswordRequired: False. The README names alice as the administrator.
- Confirm
aliceis in Administrators. - Set a password on Administrator, rename to
sysowner, disable. - Disable Guest, rename to
visitor.
Verify¶
Get-LocalUser | Where { $_.SID -like "*-50[01]" } | Select Name, Enabled
Both should show Enabled: False, and neither name should be the original.