Key Points
- The Built-in Administrator account in Windows 11 is disabled by default and bypasses UAC, giving full system access.
- It can be enabled via Command Prompt, PowerShell, Local Users and Groups, Local Security Policy, or Windows Recovery Environment (WinRE).
- The feature is most useful for troubleshooting, recovery, and system maintenance when other admin accounts are unavailable.
- Enabling this account without a strong password creates serious security risks and should only be temporary.
- Windows 11 Home edition users cannot use lusrmgr.msc or secpol.msc, but Command Prompt and PowerShell methods still work.
A built-in administrator account is a Windows 11 feature that’s disabled by default. It serves as the local system administrator with elevated rights, bypassing User Account Control (UAC) prompts.
Scenarios such as troubleshooting, advanced configurations, or regaining access when other administrator accounts are unavailable may warrant enabling the built-in admin account. Meanwhile, some prefer to disable this feature to preserve system security. But whichever setting you choose, knowing how to enable or disable built-in Administrator account in Windows 11 gives you greater control over your system’s security and functionality.
In this article, we will guide you through configuring built-in administrator accounts in Windows 11. But before proceeding, it’s important to understand the key points:
- Elevated privileges: The built-in admin account grants full access to system files, settings, and all user data.
- Security risks: If not properly secured, it can become a significant target for malware or unauthorized access.
- Use cases: It’s best suited for tasks like system maintenance, deep troubleshooting, or account recovery.
NinjaOne’s scripting and automation capabilities let you enforce Administrator account policies at scale.
Prerequisites
Here are some requirements your system needs to meet first before continuing:
- Administrative access: You’ll need admin rights on the current user account to make these changes.
- Backup your system: Before modifying account settings, it’s a good idea to create a restore point or full system backup.
- Windows edition: Some methods are only available on Windows 11 Pro, Enterprise, or Education editions.
Method 1: Using Command Prompt
This method is applicable across all Windows 11 editions.
- Press the Windows key + X and select Windows Terminal (Admin).
- To configure the built-in administrator account:
- Type net user Administrator /active:yes to enable the account.
- Type net user Administrator /active:no to disable the account.
- Hit Enter.
- Once enabled, the built-in admin account will appear on the login screen.
⚠️ Important: If your system uses a different language, replace “Administrator” with the localized account name.
Method 2: Using PowerShell
This method is also applicable across all Windows 11 editions.
- Press the Windows key and type PowerShell.
- From the search results, right-click PowerShell and choose Run as administrator from the context menu.
- To configure the built-in administrator account:
- Type Enable-LocalUser -Name “Administrator” to enable the account.
- Type Disable-LocalUser -Name “Administrator” to disable the account.
- Hit Enter.
⚠️ Important: Be sure to run PowerShell with administrative privileges to execute these commands successfully.
Method 3: Using Local Users and Groups
This method only applies to Windows 11 Pro, Enterprise, and Education editions.
- To open the Local Users and Groups management console, press Windows key + R, type lusrmgr.msc, and hit Enter.
- In the left pane, select Users.
- Double-click Administrator from the list of accounts.
- To enable the account, uncheck the box labeled Account is disabled.
- To disable it, check that box.
- Click Apply, then OK.
- The changes take effect immediately.
Best Practices for Using the Built-in Administrator AccountAdditional considerations
Enabling the built-in administrator account can be a valuable practice for some situations. However, users need to manage this feature carefully by considering the following factors:
- Security risks: The built-in Administrator account has elevated privileges and is not subject to UAC prompts, making it a target for malicious activities.
- Password protection: This account does not have a password by default. It’s crucial to set a strong password if you plan to enable it.
- Usage recommendations: Enable the built-in Administrator account only when necessary and disable it afterward to maintain system security.
Quick-Start Guide
NinjaOne can help with managing the built-in administrator account in Windows 11. Specifically, there are a few relevant scripts:
1. “Disable Local Admin Tools” script: This can disable administrator tools.2. “Enable Local Admin Tools” script: This can enable administrator tools.
These scripts can be used to manage administrator account access. However, for the specific task of enabling or disabling the built-in administrator account, NinjaOne provides a comprehensive set of user and account management capabilities:
- There’s a script for “Disable Local User” which can be used to disable local accounts
- The platform offers Active Directory User Management that allows technicians to manage users directly within the NinjaOne app
For the most precise method, I recommend consulting with your NinjaOne administrator or IT support team to ensure the correct approach for your specific environment, as account management can have security implications.
Bonus Method: Using Windows Recovery Environment (WinRE)
⚠️ Important: Editing the registry carries risk and should be your last resort. Be sure you understand the changes you’re making, and always have a backup available.
If you cannot log into any user account, you can enable the built-in admin account through the Windows Recovery Environment.
- Restart your PC while holding the Shift key and select Restart from the Start menu.
- Navigate to Troubleshoot > Advanced options > Command Prompt
- In Command Prompt, type regedit to open the Registry Editor.
- In the Registry Editor, select HKEY_LOCAL_MACHINE and click File > Load Hive.
- Browse to C:\Windows\System32\Config\SAM
- Load the SAM file and name it TEMPHIVE.
- Navigate to:
HKEY_LOCAL_MACHINE\TEMPHIVE\SAM\Domains\Accounts\Users\000001F4 - Double-click on the F binary value.
- Locate the value at offset 0x38 and change it from 11 to 10 to enable the account.
- Unload the hive from the File menu and restart your system.
Additional considerations
Enabling the built-in administrator account can be a valuable practice for some situations. However, users need to manage this feature carefully by considering the following factors:
- Security risks: The built-in Administrator account has elevated privileges and is not subject to UAC prompts, making it a target for malicious activities.
- Password protection: This account does not have a password by default. It’s crucial to set a strong password if you plan to enable it.
- Usage recommendations: Enable the built-in Administrator account only when necessary and disable it afterward to maintain system security.
NinjaOne’s scripting and automation capabilities let you enforce Administrator account policies at scale.
Configuring the built-in administrator account
The built-in Administrator account is a powerful recovery tool in Windows 11. Use it only when necessary, protect it with a strong password, and disable it after use to maintain system security.
Multiple methods are available, ranging from Command Prompt and PowerShell to advanced tools like Local Security Policy, so administrators can choose the approach that best fits their Windows edition and situation.
