Skip to content

Built-in Administrator and Guest

Every Windows install creates two accounts, and attackers know them by name.

Administrator has full control and a well-known identity. Password-guessing tools try it first.

Guest lets someone log in with no password. It's disabled by default; an image may have enabled it.

Windows identifies accounts by SID, not name. The built-in Administrator's SID always ends in -500 and Guest's in -501, so renaming doesn't hide them from someone already on the machine. It does defeat remote scripts that try the name Administrator.

Find them by SID

Get-LocalUser | Where { $_.SID -like "*-500" -or $_.SID -like "*-501" } | Select Name, Enabled, SID

This catches them even if they've been renamed.

Guest

Disable it (CIS 2.3.1.1). Rename it too (2.3.1.4).

net user Guest /active:no

PowerShell to rename:

Rename-LocalUser -Name Guest -NewName visitor

lusrmgr.msc → Users → right-click Guest → Properties → tick Account is disabled. Right-click → Rename.

Administrator

Three steps, in this order (renaming is CIS 2.3.1.3):

  1. Give it a strong password. Even if you disable it, a blank or weak password on this account is a problem if anything ever re-enables it.
  2. Rename it.
  3. Disable it, unless the README says something uses it.
net user Administrator Str0ng!Adm1nP@ss

Rename-LocalUser -Name Administrator -NewName sysowner
Disable-LocalUser -Name sysowner

Warning

Make sure another account is in the Administrators group before disabling this one. If it's the only administrator, you'll lock yourself out of administrative work.

Example

Get-LocalUser shows Guest enabled and Administrator enabled with PasswordRequired: False. The README names alice as the administrator.

  1. Confirm alice is in Administrators.
  2. Set a password on Administrator, rename to sysowner, disable.
  3. Disable Guest, rename to visitor.

Verify

Get-LocalUser | Where { $_.SID -like "*-50[01]" } | Select Name, Enabled

Both should show Enabled: False, and neither name should be the original.

Try it

  1. Check the state of Administrator and Guest with net user, then rename one and confirm the SID didn't change (wmic useraccount get name,sid).
  2. Disable Guest, then try to log in as Guest at the lock screen and read the message.

Build it

Add three lines to your account script: report whether Administrator and Guest are enabled and whether either still has its default name.

Next

Passwords and Expiry