Windows 8.1 offers a staggering variety of accounts: Administrator, Standard, Local, Microsoft, and Child. What are the differences among them? And which should you choose? Here's an easy rundown: Administrator: If you're the owner of a PC, make sure you have an
Administrator account. In fact, Windows 8.1 automatically grants an Administrator account to the first person who signs in to a new PC. That person effectively owns the PC, is the only person with the power to install new programs, and can create accounts for other people to use the PC. If you trust somebody completely, you can give that person an Administrator account, as well. Standard: Everybody else using the PC should have
a Standard account. Standard accounts come with limits that keep them from installing programs (and potential viruses). Create Standard accounts for everybody else who will be using your PC. When you've signed in with an Administrator account on your own PC, Windows automatically assigns Standard accounts to every other account you create. (You can change them to Administrator accounts later if you must.) The next three accounts are simply either an Administrator
account or a Standardaccount. The difference is whether the account is linked only to your own PC (Local) or linked with Microsoft's own computers (Microsoft). Here's the rundown: Local: Whenever you try to create a new account, Windows 8.1 makes you choose between a Microsoft account and a Local account. Choose a Local account because it's the least confusing option. Local simply means that the account is limited to
your own PC. Microsoft Account: Windows 8 introduced a new account called a Microsoft account. It simply means that that person's account is tied to Microsoft's computers. Microsoft then remembers all of that person's settings in Windows: his choice of desktop wallpaper and Wi-Fi network logon information, for example, as well as any downloaded or purchased apps. Some people prefer the benefits of a Microsoft account; others don't. Like Local
accounts, Microsoft accounts can be either Administrator or Standard accounts. Child account: Although Windows 8.1 makes this seem like a new type of account, it's simply a Standard account with the Family Safety controls already turned on. If you create Standard accounts for your children and then turn on the Family Safety controls to track their computer use, you've effectively created a "Child" account. Don't think that you need to create a
Microsoft account for every new account on your PC. Instead, you're always safest by creating a Local account. If you create a Local account for somebody who prefers a Microsoft account, he can always change it to a Microsoft account on his own. However, his Microsoft account will always remain in the category you've granted it: Administrator or Standard. About This ArticleThis article is from the book:
About the book author:Andy Rathbone's computer books, which include Windows? 2000 Professional For Dummies? and Upgrading and Fixing PCs For Dummies?, have sold more than 11 million copies. This article can be found in the category:
Skip to main content This browser is no longer supported. Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support. Local Accounts
In this articleApplies To: Windows Storage Server 2008 R2, Windows Server 2008, Windows 7, Windows 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 8 This reference topic for the IT professional describes the default local user accounts for servers, including how to manage these built-in accounts on a member or standalone server. This topic does not describe the default local user accounts for an Active Directory domain controller. Did you mean…
About local user accountsLocal user accounts are stored locally on the server. These accounts can be assigned rights and permissions on a particular server, but on that server only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users. This topic describes the following:
For information about security principals, see Security Principals Technical Overview. Default local user accountsThe default local user accounts are built-in accounts that are created automatically when you install the Windows Server operating system on a stand-alone server or member server. The Applies To list at the beginning of this article designates the Windows operating systems to which this topic applies. After the Windows Server operating system is installed, the default local user accounts cannot be removed or deleted. In addition, default local user accounts do not provide access to network resources. Default local user accounts are used to manage access to the local server’s resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC). Computer Management is a collection of administrative tools that you can use to manage a single local or remote computer. For more information, see How to manage local user accounts later in this topic. The default local user accounts that are provided include the Administrator account, Guest account and HelpAssistant account. Each of these default local user accounts is described in the following sections. Administrator accountThe default local Administrator account is a user account for the system administrator. Every computer has an Administrator account (SID S-1-5-domain-500, display name Administrator). The Administrator account is the first account that is created during the installation for all Windows Server operating systems, and for Windows client operating systems. For Windows Server operating systems, the Administrator account gives the user full control of the files, directories, services, and other resources that are under the control of the local server. The Administrator account can be used to create local users, and assign user rights and access control permissions. The Administrator account can also be used take control of local resources at any time simply by changing the user rights and permissions. The default Administrator account cannot be deleted or locked out, but it can be renamed or disabled. The default Administrator account is initially installed differently for Windows Server operating systems, and the Windows client operating systems. The following table provides a comparison.
In summary, for Windows Server operating systems, the Administrator account is used to set up the local server only for tasks that require administrative rights. The default Administrator account is set up by using the default settings that are provided on installation. Initially, the Administrator account is not associated with a password. After installation, when you first set up Windows Server, your first task is to set up the Administrator account properties securely. This includes creating a strong password and securing the Remote control and Remote Desktop Services Profile settings. You can also disable the Administrator account when it is not required. In comparison, for the Windows client operating systems, the Administrator account has access to the local system only. The default Administrator account is initially disabled by default, and this account is not associated with a password. It is a best practice to leave the Administrator account disabled. The default Administrator account is considered only as a setup and disaster recovery account, and it can be used to join the computer to a domain. When administrator access is required, do not sign in as an administrator. You can sign in to your computer with your local (non-administrator) credentials and use Run as administrator. For more information, see Security considerations. Account group membership By default, the Administrator account is installed as a member of the Administrators group on the server. It is a best practice to limit the number of users in the Administrators group because members of the Administrators group on a local server have Full Control permissions on that computer. The Administrator account cannot be deleted or removed from the Administrators group, but it can be renamed or disabled. Security considerations Because the Administrator account is known to exist on many versions of the Windows operating system, it is a best practice to disable the Administrator account when possible to make it more difficult for malicious users to gain access to to the server or client computer. You can rename the Administrator account. However, a renamed Administrator account continues to use the same automatically assigned security identifier (SID), which can be discovered by malicious users. For more information about how to rename or disable a user account, see Disable or activate a local user account and Rename a local user account. As a security best practice, use your local (non-Administrator) account to sign in and then use Run as administrator to accomplish tasks that require a higher level of rights than a standard user account. Do not use the Administrator account to sign in to your computer unless it is entirely necessary. For more information, see Using Run as. In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group. However, when multiple users run as local administrators, the IT staff has no control over these users or their client computers. In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer. For more information about Group Policy, see Group Policy Overview and Group Policy. Note Blank passwords are not allowed in the versions designated in the Applies To list at the beginning of this topic. Important Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled. Guest accountThe Guest account (SID S-1-5-32-546) is disabled by default on installation. The Guest account lets occasional or one-time users, who do not have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it is a security risk. For this reason, it is a best practice to leave the Guest account disabled, unless its use is entirely necessary. Account group membership By default, the Guest account is the only member of the default Guests group, which lets a user sign in to a server. On occasion, an administrator who is a member of the Administrators group can set up a user with a Guest account on one or more computers. Security considerations When an administrator enables the Guest account, it is a best practice to create a strong password for this account. In addition, the administrator on the computer should also grant only limited rights and permissions for the Guest account. For security reasons, the Guest account should not be used over the network and made accessible to other computers. When a computer is shutting down or starting up, it is possible that a guest user or anyone with local access could gain unauthorized access to the computer. To help prevent this risk, do not grant the Guest account the Shut down the system user right. In addition, the guest user in the Guest account should not be able to view the event logs. After the Guest account is enabled, it is a best practice to monitor the Guest account frequently to ensure that other users cannot use services and other resources, such as resources that were unintentionally left available by a previous user. HelpAssistant account (installed by using a Remote Assistance session)The default HelpAssistant account is enabled when a Windows Remote Assistance session is run. The Windows Remote Assistance session can be used to connect from the server to another computer running the Windows operating system. For solicited remote assistance, a user initiates a Windows Remote Assistance session, and it is initiated by invitation. For solicited remote assistance, a user sends an invitation from their computer, through e-mail or as a file, to a person who can provide assistance. After the user’s invitation for a Windows Remote Assistance session is accepted, the default HelpAssistant account is automatically created. The HelpAssistant account provides limited access to the computer to the person who provides assistance. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service. The HelpAssistant account is automatically deleted after there are no Remote Assistance requests are pending. The security identifiers (SIDs) that pertain to the default HelpAssistant account include:
For the Windows Server operating system, Remote Assistance is an optional component that is not installed by default. You must install Remote Assistance before it can be used. In comparison, for the Windows client operating system, the HelpAssistant account is enabled on installation by default. For more information about remote desktop connections for those client operating systems designated in the Applies To list at the beginning of this topic, see Enable Remote Desktop. Default local system accountsThe system account and the Administrator account of the Administrators group have the same file rights and permissions, but they have different functions. The system account is used by the operating system and by services that run under Windows. There are many services and processes in the Windows operating system that need the capability to sign in internally, such as during a Windows installation. The system account was designed for that purpose. It is an internal account that does not show up in User Manager, it cannot be added to any groups, and it cannot have user rights assigned to it. On the other hand, the system account does appear on an NTFS file system volume in File Manager in the Permissions portion of the Security menu. By default, the system account is granted Full Control permissions to all files on an NTFS volume. Here the system account has the same functional rights and permissions as the Administrator account. Note To grant the account Administrators group file permissions does not implicitly give permission to the system account. The system account's permissions can be removed from a file, but we do not recommend removing them. How to manage local user accountsThe default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC), a collection of administrative tools that you can use to manage a single local or remote computer. For more information about creating and managing local user accounts, see Manage Local Users. You can use Local Users and Groups to assign rights and permissions on the local server, and that server only, to limit the ability of local users and groups to perform certain actions. A right authorizes a user to perform certain actions on a server, such as backing up files and folders or shutting down a server. An access permission is a rule that is associated with an object, usually a file, folder, or printer. It regulates which users can have access to an object on the server and in what manner. You cannot use Local Users and Groups to view local users and groups after a member server is used as a domain controller. However, you can use Local Users and Groups on a domain controller to target remote computers that are not domain controllers on the network. Note You use Active Directory Users and Computers to manage users and groups in Active Directory. Restrict and protect local accounts with administrative rightsAn administrator can use a number of approaches to prevent malicious users from using stolen credentials, such as a stolen password or password hash, for a local account on one computer from being used to authenticate on another computer with administrative rights; this is also called "lateral movement". The simplest approach is to sign in to your computer with a standard user account, instead of using the Administrator account for tasks, for example, to browse the Internet, send email, or use a word processor. When you want to perform an administrative task, for example, to install a new program or to change a setting that affects other users, you don't have to switch to an Administrator account. You can use User Account Control (UAC) to prompt you for permission or an administrator password before performing the task, as described in the next section. The other approaches that can be used to restrict and protect user accounts with administrative rights include:
Each of these approaches is described in the following sections. Note These approaches do not apply if all administrative local accounts are disabled. Enforce local account restrictions for remote accessThe User Account Control (UAC) is a security feature in Windows that has been in use in Windows Server 2008 and in Windows Vista, and the operating systems to which the Applies To list refers. UAC enables you to stay in control of your computer by informing you when a program makes a change that requires administrator-level permission. UAC works by adjusting the permission level of your user account. By default, UAC is set to notify you when applications try to make changes to your computer, but you can change how often UAC notifies you. UAC makes it possible for an account with administrative rights to be treated as a standard user non-administrator account until full rights, also called elevation, is requested and approved. For example, UAC lets an administrator enter credentials during a non-administrator's user session to perform occasional administrative tasks without having to switch users, sign out, or use the Run as command. In addition, UAC can require administrators to specifically approve applications that make system-wide changes before those applications are granted permission to run, even in the administrator's user session. For example, a default feature of UAC is shown when a local account signs in from a remote computer by using Network logon (for example, by using NET.EXE USE). In this instance, it is issued a standard user token with no administrative rights, but with the ability to request or receive elevation. Consequently, local accounts that sign in by using Network logon cannot access administrative shares such as C$, or ADMIN$, or perform any remote administration. For summary information about UAC, see User Account Control. For detailed information about special conditions when you use UAC, see User Account Control. The following table shows the Group Policy and registry settings that are used to enforce local account restrictions for remote access.
To enforce local account restrictions for remote access
Deny network logon to all local Administrator accountsDenying local accounts the ability to perform network logons can help prevent a local account password hash from being reused in a malicious attack. This procedure helps to prevent lateral movement by ensuring that the credentials for local accounts that are stolen from a compromised operating system cannot be used to compromise additional computers that use the same credentials. Note In order to perform this procedure, you must first identify the name of the local, default Administrator account, which might not be the default user name "Administrator", and any other accounts that are members of the local Administrators group. The following table shows the Group Policy settings that are used to deny network logon for all local Administrator accounts.
To deny network logon to all local administrator accounts
Create unique passwords for local accounts with administrative rightsPasswords should be unique per individual account. While this is generally true for individual user accounts, many enterprises have identical passwords for common local accounts, such as the default Administrator account. This also occurs when the same passwords are used for local accounts during operating system deployments. Passwords that are left unchanged or changed synchronously to keep them identical add a significant risk for organizations. Randomizing the passwords mitigates "pass-the-hash" attacks by using different passwords for local accounts, which hampers the ability of malicious users to use password hashes of those accounts to compromise other computers. Passwords can be randomized by:
See alsoThe following resources provide additional information about technologies that are related to local accounts.
Which type of user account is created automatically during a Windows 8.1 installation guest?By default, the user account you created when setting up Windows 8 is an Administrator account.
Which type of user account is created automatically during a Windows installation?Default local user accounts. The default local user accounts are built-in accounts that are created automatically when you install Windows. After Windows is installed, the default local user accounts can't be removed or deleted. In addition, default local user accounts don't provide access to network resources.
Which type of user account is created automatically during a?During a Windows 8.1 installation the Administrator account is created automatically. All other accounts have to be created manually.
What are the different kinds of user accounts in Windows OS 8/8.1 10?Windows 8 offers four basic types of user accounts: the built-in Administrator account, user accounts with administrative privileges, standard accounts, and a Guest account.
|