What you should know about the Windows 10 Administrator account and other user accounts

Introduction

How Windows manages its user accounts is an involved and somewhat confusing topic that most people instinctively want to avoid getting to grips with if possible. The options have increased in Windows 8.1/10 with the default login using a Microsoft [email] account that is required to download apps from the Microsoft Store.

In my opinion, it is well worth making the effort to get to grips with the increased user account options, if only because the privacy of your personal information depends on doing so. The following information should enable you to clear the confusion.

You should know how to access the hidden master Administrator account because you are not allowed to access the most elevated areas of Windows that have the highest level of access privileges unless you are logged in as Administrator. You will see a message saying as much if you try to do so from the User account with admin-level of access privileges that Windows provides as the default user account.

Windows 10 – as well as Windows 7 and 8.1 – provide three primary accounts – the user account with an admin-level of access privileges that Windows sets up and uses by default for the owner of the computer – it can be local on the computer or a Microsoft [email] account – and the standard and Administrator user accounts.

A Guest account can no longer be enabled in Windows 10, as is the case in previous versions. The following article explains the current situation.

You can’t enable the Guest account in Windows 10. Stop trying! –

http://www.digitalcitizen.life/you-cant-enable-guest-account-windows-10-stop-trying

All user accounts, including the master Administrator account, can and should be given user-name and password logins. If a person other than the computer’s owner/administrator is given a standard user account, the owner and the other person no doubt both want to keep their individual accounts private with their own user names and passwords.

A standard user account has to be created and it can be a local account, existing on the computer only, or it can be a Microsoft [email] account. Logging in with a Microsoft [email] account requires using the user name and password for the email account, not the password for a local Windows login.

The master Administrator account has to be enabled otherwise it remains hidden.

A default user account, used by the computer’s owner/administrator, and a standard user account  (created for that user or other users), with admin-level privileges, provide User Account Control (UAC) by default – the user has to give permission to install or use software. The master Administrator account is not governed by UAC.

There is no limit to the number of user accounts that can be created – one for every member of a family – but each new account is given the privileges of a standard account unless its status is changed to one of the two other possibilities.

A Microsoft cloud-based account or a local computer-based account?

A user can sign in to Windows 8.1/10 with a Microsoft account – username@hotmail.com, username@live.com, username@msn.com, username@passport.com and username@outlook.com –  that requires the password for that email account to log into Windows. Accounts can be set up for members of a family and other users.

Here is the click path to follow: Start => Settings  => Accounts => Family & other users.

Using a Microsoft account allows users to syncronise passwords, themes, web-browser settings, OneDrive cloud-storage files and other settings between devices. Note that Windows Store apps and Start menu layouts cannot be synchronised.

Microsoft, like Google, helps itself to your personal information if you use a Microsoft account instead of a local user account on the computer. Therefore, for the greatest privacy review your privacy settings under Start => Settings and use a local account, not an email account. Unfortunately, the only way to access the Microsoft Store is to use a Microsoft account.

A local account does not make use of Win10’s web cloud-based connections that use a Microsoft account. Users can create a new local account or change an existing Microsoft account into a local account. To change an account, click Start => Accounts and choose the MS email account that you want to convert. Next, click the “Sign in with a local account instead”.

The tightly restricted Child user account

The higher the level of account that is used for a computer that has access to the web, the more access privileges it provides, the more vulnerable that computer is to malware. Therefore, from a security point of view, it’s best to create and use a restricted account that is not allowed to install software or make changes to the settings, etc., such as a Child account.

To create a child account, open Start => Settings => Accounts => Family & other users => Add a family member => Add a child and work through the wizard. Unfortunately, an email address has to be provided for a Child account, because it has to be a Microsoft account. Many parents have complained to Microsoft about that requirement due to the implications of privacy-invasion.

Add a child account to your family –

https://support.microsoft.com/en-us/help/12417/microsoft-account-add-child-account

At least two accounts are required: a standard local user account that has an administration-level of access privileges and a backup account with enough access privileges to repair that account if it becomes corrupt. The backup account could be the hidden Administrator account, which provides a full set of privileges, or a second standard account that the user creates.

The Windows 10 (master) Administrator account

To use the master Administrator account, it first has to be enabled, because it is hidden. The Command Prompt is the best way to enable and disable it.

About the Command prompt

Most Windows PCs use the C: drive as the boot drive, but it could be given any letter. The Command Prompt looks like this at the root directory: C:\>. If it looks like this: C:\Documents and Settings\User Name>, the Command Prompt is in the directory/folder of that user name. The cd /? command lists the switches that can be used with the cd command. You can use the dir command to list the files in a directory. The dir /? command provides the switches that can be used with the dir command.

You can also keep adding directories to move up the hierarchy just by using the exact path to them. Here is an example of a path you can go up: C:\Documents and Settings\User name\My Documents\My Videos. When you get there, all of the files in the My Videos directory/folder will be listed. You can use the cd command to go up and down the Windows file structure.

The command C:\Users\Me\chkdsk /? is shown in the image below to bring up the switches that the chkdsk command provides.

Enable the hidden Administrator account

The master Administrator account has to be enabled because it is hidden. To do that using the Command Prompt, right-click on Win10 Start button and type the command cmd in the Search box. Find the Command Prompt option above the Search box and right-click on it. A menu with four options is presented. Click on Run as Administrator. Give UAC permission to go ahead. Alternatively, right-click on Start and click on the Command Prompt (Admin) option. The end result is the same.

Enter net user at the Command Prompt to bring up a list of the current user accounts. Entering the net user administrator /active:yes command enables the master Administrator account. Changing yes to no disables it.

[Note that the commands to enable/disable a Guest account  – guest /active:yes  – guest /active:no – no longer work in the latest version of Win10.]

You can now access the Windows Administrator account — no password is required That is a security weakness, so set one by entering  net user administrator *. Enter a new password as prompted and again for confirmation. Close the Command Prompt window.

To sign in to the Administrator account, click on Start followed by your user name (at the top of the Start menu). Click on Administrator and enter your password. Win10 might take a while to set the account up. If you need a video demonstration, here one is:

Your choice: To use standard or admin-level user accounts

From a security point of view, it’s advisable to create and use a standard account with fewer privileges and use it instead of the default user account that has admin-level privileges, because privileges are used by hackers and cyber criminals to gain access to and compromise a system. The fewer the access privileges, the more difficult it is to make malware work effectively.

In Windows XP/Vista/7 to set up new user accounts and change existing accounts is done by opening the Control Panel => User Accounts.

Here is an article on user accounts in Windows 8.1:

How to Add Windows 8.1 Users –

http://www.dummies.com/how-to/content/how-to-add-windows-81-users.html

For Windows 10, as shown earlier in this article, this is the click path: Start => Settings => Accounts => Family & other users to add another account.

You also have to go to Start => Settings => Accounts to manage email, user-account settings, sign-in options and other account settings, such as Sync your settings on multiple devices – PC’s, tablets, smartphones. If your settings are synchronised across all of your devices, everything that you change or do on one device is made available to every other device that you use.

Windows 10 has inherited spit settings interfaces from Windows 8.1, you can change account types via either Start => Settings or Control Panel => User Accounts. Depending on the type of account, the Control Panel option has more account-management controls, such as change account names and set advanced user-profile properties.

The hidden User Accounts control panel, Netplwiz

There is a User Accounts control panel in Windows Vista/7/8.1/10 called Netplwiz. It is used to enable logging in without using a password and provides other options. For example, select a user and click the Properties button. There it is possible to  change an account’s username, full name and select the account type: Standard, Administrator and Other. See Fig. 1 and Fig.3 below.

Netplwiz is not available in the main Windows Control Panel. To access it, open a Command Prompt, as instructed earlier in this article, and enter netplwiz. There are no switches for that command.

In the Users tab, uncheck the top box next to “Users must enter a user name and password to use this computer” if you want to boot straight into the Desktop. Fig 1 shows the two tabs – Users and Advanced. The Advanced options are only available in Windows 10 Pro.