Windows Forum

Ask something
Discussion Locked

Adminstrators Account Password Lockout

0 helpful
10 replies

by a former member

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
How can I prevent another user with adminstrative privileges changing the built in admininstrator password in Windows 2000. I've had an experience where external tech support changed the built in account password while working on the machine using a user logon to whom I had granted full administrator priveleges. I am concerned only with a small workgroup network using 2000 professional on each machine.

10 replies

by willcomp

1. There is no "built-in" admin password. You can leave it blank, which means anyone can log on as Administrator.

2. You must know the password in order to change it.

3. Assign the Administrator account a secure password.

4. A knowledgable tech can clear the Administrator password using one of several tools to reset passwords. These are usually Linux boot disks that read the SAM file and allow passwords to be reset to blanks.

Dalton

by Former member

Thanks for responding, but is it not the case that anyone with administrative privileges can reset the password, without knowing the password for the built in adminisrator account. As long as they know the password to access an account with administrative privileges they can reset the password on the built in adminstrator account. It is this problem I am trying to avoid. I don't want locked out of my own system

by statykserver

To put it simply an administrator is an administrator. Anyone with administrative rights has the right to change ALL passords so what you should do is when creating a user for the external techs is only grant them rights they require for their job. Either that or download this free utility and change the password back everytime they change it for you.

http://www.lostpassword.com/windows-xp-2000-nt.htm

by statykserver

This will reset the administrator password back to a the program default or one you specify. I've used it plenty of times and works 100%.

by cg it

The local machine administrator account is a security group account. The default admin account with the name administrator is a member of that group. other users added to that "security group" are also administrators with full access. There is no way to limit another administrator that is a member of the adiministrators security group full access to the machine or other machines in the workgroup that also have that administrators account on it. What you can do is use the Power Users security group. Grants just about all the accesses that an administrator has, e.g. allows installation of programs, backups etc but without the full access.

It is a defacto standard that one does not use the administrators account for normal computer use. One creates a power user account and uses that so that if someone were to peek and gain the user name and password, it would only be a power user access and not full access. Its also defacto standard to rename the local administrators account and to use a complexity password for it.

by rindi1

You could install a Windows server System with active directory. Inside Active directory you can set up organizational units. inside those organizational units you can assign administrational accounts which are only allowed full access from that unit onwards, which means the master administrational account doesn't get touched.

by Former member

This question was closed by the author

This discussion is closed to new replies.