Enable or Disable Built-in Administrator in Windows 10

You can enable or disable the built-in Administrator account in Windows 10 using Command Prompt, PowerShell, or Local Security Policy, depending on your Windows edition. The quickest method is to run net user administrator /active:yes (or /active:no to disable) in an elevated Command Prompt.

What Is the Built-in Administrator Account?

Windows 10 includes a hidden account named Administrator that has full, unrestricted access to the system. It is different from the standard user account you create during setup, even if that account is a member of the Administrators group. The built-in account is often called the “super admin” because it bypasses User Account Control (UAC) prompts entirely—every action runs with the highest privilege level, which is both powerful and risky.

By default, this account is disabled. Microsoft hides it from the login screen and the user management panel, so most people never see it. It exists primarily for troubleshooting, recovery, and domain-joined environments where an administrator needs a fallback account. Enabling it gives you a way to fix system problems when your normal account is locked out or corrupted, but it also removes a layer of security because any malware running under that account has full control.

Why You Might Want to Enable It

There are a few legitimate reasons to turn on the built-in Administrator:

Recovery after a broken user profile: If your main account fails to load or you forget the password, the built-in Administrator can be used to reset it or back up files.
Running elevated tasks without UAC prompts: Some advanced scripts or tools require repeated elevation, and the built-in account avoids the constant “Yes/No” prompts.
Cleanup of stubborn files or permissions: Because it has full rights, it can take ownership of system files that even admin users cannot touch normally.
Testing software in a clean environment: IT professionals often enable it on test machines to simulate a fully privileged user.

However, for daily use, you should stick with a standard administrator account. The built-in account has no UAC protection, so any mistake—or any malicious program—can change system settings, delete files, or install software without asking.

Method 1: Enable or Disable via Command Prompt

This works on all editions of Windows 10, including Home. You need to run Command Prompt as an administrator.

Click the Start button, type cmd, right-click Command Prompt, and select Run as administrator.
If UAC prompts, click Yes.
To enable the built-in Administrator, type the following and press Enter:
net user administrator /active:yes
To disable it later, type:
net user administrator /active:no

You should see the message “The command completed successfully.” The account will appear on the login screen immediately (if enabled). If you want to set a password for it, use net user administrator * and type a new password when prompted.

Method 2: Enable or Disable via PowerShell

PowerShell gives you the same control with a different command. Open PowerShell as administrator (right-click Start and choose Windows PowerShell (Admin)).

To enable, run:
Get-LocalUser -Name "Administrator" | Enable-LocalUser
To disable, run:
Get-LocalUser -Name "Administrator" | Disable-LocalUser

PowerShell is especially useful if you want to check the current status first: Get-LocalUser -Name "Administrator" | Select-Object Name, Enabled. The output will show True or False.

Method 3: Enable or Disable via Local Security Policy (Pro and Enterprise Only)

Windows 10 Pro, Enterprise, and Education include the Local Security Policy editor. Home edition does not have this tool.

Press Win + R, type secpol.msc, and press Enter.
Navigate to Security Settings → Local Policies → Security Options.
Double-click Accounts: Administrator account status.
Select Enabled or Disabled and click OK.

This method is handy for IT admins who want to enforce the setting across multiple machines via Group Policy. The change takes effect immediately, but the account may require a password if it has never been set.

How to Choose Between Built-in and Standard Admin

For everyday work, create a separate standard user account and use it for browsing, email, and documents. Keep an administrator account (one that belongs to the Administrators group but is not the built-in one) for installing software and changing system settings. The built-in Administrator should be reserved for emergencies.

If you enable the built-in account, consider these best practices:

Set a strong, unique password immediately.
Disable it as soon as the task is done.
Never use it as your daily logon.
Keep it off on machines that are exposed to the internet or untrusted networks.

Common Problems and How to Fix Them

Sometimes the commands don’t work as expected. Here are typical issues and their solutions:

“Access is denied” error: You are not running the command prompt as administrator. Right-click and choose Run as administrator.
Account does not appear on login screen: The account might be enabled but hidden. Press Ctrl + Alt + Delete and choose Switch user to see it. Or use net user administrator to confirm status.
Cannot log in because the password is unknown: The built-in account has no password by default when enabled. If you set one and forgot it, use another admin account to reset it via net user administrator *.
Home edition doesn’t have secpol.msc: Use the Command Prompt or PowerShell method instead.
Account is enabled but UAC still prompts: That is normal—the built-in account bypasses UAC only when you log into it. If you are using it, you should not see prompts for system changes.

Safety and Security Considerations

Running with the built-in Administrator means every process—including malware—has the highest privilege level. There is no UAC filter, so a malicious script can silently disable your antivirus, read your files, and create backdoor accounts. For this reason, Microsoft recommends keeping it disabled unless absolutely necessary.

If you enable it temporarily, remember to disable it after the task. Also, make sure your antivirus is up to date and that you are not using the account to browse the web or open email attachments. The risk is not theoretical; many ransomware attacks specifically target accounts with full privileges.

Frequently Asked Questions

Is the built-in Administrator the same as my user account?

No. Your user account, even if it is an administrator type, is subject to UAC. The built-in Administrator is a separate account that bypasses UAC entirely. They have different SIDs and different profiles.

Can I delete the built-in Administrator?

You cannot delete it through normal means—it is a system account. You can only disable it. Attempting to delete it from the registry or with third-party tools can break Windows and is not recommended.

Why is the built-in Administrator disabled by default?

Security. Microsoft disables it to reduce the attack surface. An enabled, password-less super admin account is a huge vulnerability, especially on machines connected to the internet.

Will enabling the built-in Administrator affect my current files or settings?

No. It creates a separate profile. Your personal files and settings remain untouched. You will see a new user folder under C:\Users\Administrator.

What if I forget the password for the built-in Administrator?

You can reset it by logging into another admin account and running net user administrator * in an elevated command prompt. If you have no other admin access, you may need to use Windows Recovery Environment and enable the account from there.

Does enabling the built-in Administrator speed up my PC?

No. It does not improve performance. In fact, it can slow things down because some services and apps may behave differently when running with full privileges. Use it only for specific tasks.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →