{"id":1489,"date":"2018-11-16T11:47:40","date_gmt":"2018-11-16T11:47:40","guid":{"rendered":"http:\/\/www.RiptideHosting.com\/blog\/?p=1489"},"modified":"2019-10-18T15:34:23","modified_gmt":"2019-10-18T15:34:23","slug":"disable-built-in-administrator-account","status":"publish","type":"post","link":"https:\/\/www.RiptideHosting.com\/blog\/disable-built-in-administrator-account\/","title":{"rendered":"Disable built-in Administrator account"},"content":{"rendered":"

Disable built-in Administrator account<\/u><\/strong> (create alternative admin account)<\/p>\n

All Windows Servers come with the built-in Administrator account (SID 500) by default and all administrator accounts have RDP access by default (when RDP is enabled overall).\u00a0 Therefore the Administrator account, if port 3389 is open, is frequently the target of repeated brute-force hack attempts against this account name.\u00a0 Options include disabling the Administrator account completely and setup a separate account that has administrator rights, or removing RDP access from the Administrator account.\u00a0 Make sure you have a different account with admin rights available before disabling the Administrator account so you don\u2019t get locked out.\u00a0 Generally it is better to disable the Administrator account (and replace with a different account with administration rights) rather than just renaming the Administrator account because the SID remains 500 when you rename it and there are some non-Microsoft tools that allow authentication by using SID rather than account name (but renaming is still better than doing nothing\u2026.you can rename the\u00a0 Administrator account in Local Security Policy (Security Settings, Local Policies, Security Options, Accounts: Rename administrator account) or via gpedit.msc).\u00a0 \u00a0We noted on a test server with port 3389 open that over 50% of the failed login attempts were using the \u201cadministrator\u201d user name, followed by admin, user, test, user1, etc.<\/p>\n","protected":false},"excerpt":{"rendered":"

Disable built-in Administrator account (create alternative admin account) All Windows Servers come with the built-in Administrator account (SID 500) by default and all administrator accounts have RDP access by default (when RDP is enabled overall).\u00a0 Therefore the Administrator account, if port 3389 is open, is frequently the target of repeated brute-force hack attempts against this […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1489","post","type-post","status-publish","format-standard","hentry","category-all-posts"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t