Skip to main content
< All Topics
Print

How to Enable the Built-in Local Administrator Account (Windows 10/11) –

Posted
Updated
Bychris_fry

Method 1: Command Prompt (all editions, including Home)

  1. Click Start, type cmd, right-click Command Prompt, and choose Run as administrator.
  2. Enable the account:
   net user administrator /active:yes
  1. Set a password. You’ll be prompted to type it, and nothing will appear on screen as you type:
   net user administrator *
  1. Sign out. Administrator now appears on the sign-in screen.

To disable it again:

net user administrator /active:no

Method 2: PowerShell

Open PowerShell as administrator and run:

powershell

Enable-LocalUser -Name "Administrator"
Set-LocalUser -Name "Administrator" -Password (Read-Host -AsSecureString "Enter password")

To disable it: Disable-LocalUser -Name "Administrator"

Method 3: Local Users and Groups (Pro, Enterprise, and Education only)

  1. Press Win + R, type lusrmgr.msc, and press Enter.
  2. Go to Users, then double-click Administrator.
  3. Clear the Account is disabled checkbox and click OK.
  4. Right-click Administrator and choose Set Password.

Method 4: Local Security Policy or Group Policy (Pro and above, or a domain)

  1. Run secpol.msc. For domain-wide deployment, edit a GPO in gpmc.msc instead.
  2. Go to Security Settings > Local Policies > Security Options.
  3. Set Accounts: Administrator account status to Enabled.
  4. If you use a GPO, run gpupdate /force on the target machines.

Verify

net user administrator

The output should show Account active: Yes.

Notes and troubleshooting

  • Non-English Windows: The account name may be localized, for example “Administrateur” or “Administrador.” Run Get-LocalUser in PowerShell to see the exact name. You can also run wmic useraccount where "SID like '%-500'" get name to find it by its SID.
  • “System error 5 / Access is denied”: The console isn’t elevated. Reopen it with Run as administrator.
  • Renamed account: If a policy has renamed the account, use the new name in the commands. You can find it by SID with the command above.

Security considerations

  • By default, the built-in Administrator runs without UAC prompts, so everything it runs has full privileges. Use it only for troubleshooting or setup, not for daily work.
  • Always set a strong password. Never leave the account enabled with a blank password.
  • Disable the account when you’re finished.
  • In managed environments, consider Windows LAPS to rotate local admin passwords automatically.