How To Enable the Administrator Account in Windows

The secret administrator account, at that.

We tend to think of accounts on your Windows PC as being either administrator or limited. There are reasons to use both in various situations.

But what you think of as an administrator account isn’t really THE administrator account. Some computers have another account that has been referred to as a super-administrator mode.

Computers can run in limited, administrator-capable, or administrator accounts. I’ll describe the differences between the three and how to access the most powerful account of all.

Enable the administrator account

Besides the standard limited and administrator-capable accounts, there’s a more powerful administrator account. It’s disabled by default. Enable it by running “net user administrator /active:yes” in an administrative comment prompt. This account runs without UAC prompts and initially has no password, which poses a security risk. You can use it for specific maintenance tasks to avoid repeated UAC interruptions, but it’s crucial to set a password if you activate it.

Limited user accounts

Limited user accounts (LUA) run with restricted privileges. This prevents malware from being able to do whatever it might want to on your machine. When running with an LUA account you, and malware, don’t have the privileges to make system-level changes to you machine. In some corporate environments, it prevents you from making changes to your system contrary to your IT department’s wishes… but that doesn’t mean you can’t try.

When you attempt to make system-level changes while signed into a LUA, or try to run an application that requires true administrative access from the get-go, you’re likely to be presented with the UAC, or “User Account Control”, message.

In order to proceed, you must prove you are authorized to do so by providing the credentials for an administrator-capable account on that machine. Otherwise, you can’t do whatever you are trying to do.

Administrator-capable accounts

This is the default type of account created when you set up Windows. While we call them administrator accounts, they’re really not; they’re what I refer to as administrator-capable.

When running normally, they run much like an LUA. And like an LUA, when administrative access is required, you’ll see the UAC prompt.

The difference is simply that you don’t need to authenticate any further. All you need do is say “yes”. When using an administrator-capable account, no further authorization is required.

That’s the primary difference between LUA and administrator-capable accounts: whether or not UAC requires more authorization or you can just click on Yes.

The real administrator account

There is another account, called the administrator account, in every version of Windows. Using that account, you are running in administrator mode all the time. There are no UAC prompts to get in the way.

By default, it even has no password!

Also by default, you have to enable it before you can use it.

In an administrative command prompt, run:

net user administrator /active:yes

The output will be very boring.

Sign out of Windows.

On the sign-in screen, you’ll now see the Administrator account listed as an option.

Click Sign in, and you’re in as administrator. You have full control.

The built-in security hole

But wait: all you had to do was click Sign in. No password was required.

That’s a huge security issue.

So the first thing you should do is set a password.

Hit the Start button, and search for “password”. Click on Change your password when it appears. This will take you to the Sign-in options page of the Settings app.

Click on the down-arrow to the right of the “Password” item. Then click the “Add” button that appears.

Enter your new password, add a password hint, and you’re done.

So why would you want this account?

Normally, you don’t need to operate your computer from the administrative account. That’s one reason it’s disabled by default. Your administrator-capable account is all you need for day-to-day computing.

However, in some situations — perhaps involving maintenance or other situations where you’d end up facing UAC over and over again — it might be a useful way to streamline your work.

Do not use the administrator account as your regular work account. Any accidental system changes would not require confirmation. Even more troubling, malware could install itself without notice.

I recommend living with the occasional UAC.

Podcast audio

Download (right-click, Save-As) (3.9MB)

Subscribe: RSS

Related Video