How to Enable or Disable the Built-in Administrator Account in Windows 11

A built-in administrator account is a Windows 11 feature that’s disabled by default. It serves as the local system administrator with elevated rights, bypassing User Account Control (UAC) prompts.

Scenarios such as troubleshooting, advanced configurations, or regaining access when other administrator accounts are unavailable may warrant enabling the built-in admin account. Meanwhile, some prefer to disable this feature to preserve system security. But whichever setting you choose, knowing how to enable or disable built-in Administrator account in Windows 11 gives you greater control over your system’s security and functionality.

In this article, we will guide you through configuring built-in administrator accounts in Windows 11. But before proceeding, it’s important to understand the key points:

• Elevated privileges: The built-in admin account grants full access to system files, settings, and all user data.
• Security risks: If not properly secured, it can become a significant target for malware or unauthorized access.
• Use cases: It’s best suited for tasks like system maintenance, deep troubleshooting, or account recovery.

Prerequisites

Here are some requirements your system needs to meet first before continuing:

• Administrative access: You’ll need admin rights on the current user account to make these changes.
• Backup your system: Before modifying account settings, it’s a good idea to create a restore point or full system backup.
• Security Note: By default, the built-in Administrator account has no password assigned. If you enable this account on a connected network without immediately setting a strong password, you create a high-severity security vulnerability. Always set a password immediately after enabling:
  • Command Prompt: net user Administrator YourStrongPassword
  • PowerShell: Set-LocalUser -Name “Administrator” -Password (ConvertTo-SecureString “YourStrongPassword” -AsPlainText -Force)
• Windows edition: Some methods are only available on Windows 11 Pro, Enterprise, or Education editions.

Watch the video and learn how to safely manage the built-in Administrator account: How to Enable or Disable the Built-in Administrator Account in Windows 11.

Method 1: Using Command Prompt

This method is applicable across all Windows 11 editions.

1. Press the Windows key + X and select Windows Terminal (Admin).
2. To configure the built-in administrator account:
   • Type net user Administrator /active:yes to enable the account.
   • Type net user Administrator /active:no to disable the account.
3. Hit Enter.
4. Once enabled, the built-in admin account will appear on the login screen.

⚠️ Important: If your system uses a different language, replace “Administrator” with the localized account name.

Method 2: Using PowerShell

This method is also applicable across all Windows 11 editions.

1. Press the Windows key and type PowerShell.
2. From the search results, right-click PowerShell and choose Run as administrator from the context menu.
3. To configure the built-in administrator account:
   • Type Enable-LocalUser -Name “Administrator” to enable the account.
   • Type Disable-LocalUser -Name “Administrator” to disable the account.
4. Hit Enter.

⚠️ Important: Be sure to run PowerShell with administrative privileges to execute these commands successfully.

💡 Tip for Non-English Windows Systems: In non-English installations, the built-in administrator account is localized (e.g., Administrateur in French, Administrator in German, Administrador in Spanish).

If Enable-LocalUser -Name “Administrator” fails with a UserNotFound error, run the following PowerShell command to identify the exact account name using its fixed Well-Known SID:

Get-LocalUser | Where-Object { $_.SID -like “*-500” } | Select-Object Name, Enabled

Method 3: Using Local Users and Groups

This method only applies to Windows 11 Pro, Enterprise, and Education editions.

1. To open the Local Users and Groups management console, press Windows key + R, type lusrmgr.msc, and hit Enter.
2. In the left pane, select Users.
3. Double-click Administrator from the list of accounts.
4. To enable the account, uncheck the box labeled Account is disabled.
5. To disable it, check that box.
6. Click Apply, then OK.
7. The changes take effect immediately.

Bonus Method: Using Windows Recovery Environment (WinRE)

⚠️ Important: Editing the registry carries risk and should be your last resort. Be sure you understand the changes you’re making, and always have a backup available.

If you cannot log into any user account, you can enable the built-in admin account through the Windows Recovery Environment.

1. Restart your PC while holding the Shift key and select Restart from the Start menu.
2. Navigate to Troubleshoot > Advanced options > Command Prompt
3. In Command Prompt, type regedit to open the Registry Editor.
4. In the Registry Editor, select HKEY_LOCAL_MACHINE and click File > Load Hive.

💡 Note on Drive Letters: In WinRE, your main Windows installation is rarely mounted as C:. The X: drive is a temporary RAM disk, and your system partition is usually assigned D: or E:.
Before opening regedit, type diskpart then list volume in the Command Prompt to confirm which drive letter contains your Windows folder.

5. Browse to C:\Windows\System32\Config\SAM
6. Load the SAM file and name it TEMPHIVE.
7. Navigate to:
   HKEY_LOCAL_MACHINE\TEMPHIVE\SAM\Domains\Accounts\Users\000001F4
8. Double-click on the F binary value.
9. Locate the value at offset 0x38 and change it from 11 to 10 to enable the account.
10. Unload the hive from the File menu and restart your system.

Managing the Account at Scale via PowerShell / RMM

For IT administrators managing multiple endpoints, manual changes aren’t scalable. You can deploy this single-line PowerShell script through NinjaOne or your preferred RMM to automatically enable the account and set a secure password simultaneously:

$Password = ConvertTo-SecureString “YourSecurePassword123!” -AsPlainText -Force; Enable-LocalUser -Name “Administrator”; Set-LocalUser -Name “Administrator” -Password $Password

For the most precise method, consult your IT support team or system administrator to confirm the right approach for your environment, since account management changes can have security implications.

Best Practices for Using the Built-in Administrator Account – Additional considerations

Enabling the built-in administrator account can be a valuable practice for some situations. However, users need to manage this feature carefully by considering the following factors:

• Security risks: The built-in Administrator account has elevated privileges and is not subject to UAC prompts, making it a target for malicious activities.
• Password protection: This account does not have a password by default. It’s crucial to set a strong password if you plan to enable it.
• Usage recommendations: Enable the built-in Administrator account only when necessary and disable it afterward to maintain system security.

Configuring the built-in administrator account

The built-in Administrator account is a powerful recovery tool in Windows 11. Use it only when necessary, protect it with a strong password, and disable it after use to maintain system security.

Multiple methods are available, ranging from Command Prompt and PowerShell to advanced tools like Local Security Policy, so administrators can choose the approach that best fits their Windows edition and situation.