domain administrator account password reset problem

[Joseph LeMay]

this morning I set the domain group policy "Rename Administrator
Account" to "Disabled" to fix a problem. should have no effect on
anything.
then, because of a different problem, I had to reboot a server. now I
can't log in as administrator for my domain. I'm already logged in as
domain administrator on other machines, so I used one of those other
machines to reset my domain Administrator password. it resets
successfully, and I still can't log in from other machine. I've tried
doing this on one of my domain controllers. I've tried changing the
Administrator password to something else. It resets successfully, but
I still can't log in as Domain Administrator from anywhere. I get the
generic "the system could not log you on" message. I can log in to
the domain with any other account. help.

 

[Joseph LeMay]

Figured out my problem. I set the policy "Rename Administrator
Account" to "Disabled" so my Administrator account was renamed to
"Disabled." I changed it back to "Administrator" and everything
worked.

So now my only question is how are you supposed to set the "Rename
Administrator Account" domain policy? or moreover, what's it for if
all it does is go ahead and rename the Administrator account? The
dialog you use to set it has a check mark for "Define this policy
setting" and then a blank line where you can type something. I want
to prevent people from renaming the Administrator account.

 

[Steven L Umbach]

By default the domain policy is undefined which would allow local administrators to
change the name. If you want to prevent users from changing the name, then enable the
setting and enter administrator. The reason for that setting is that the
administrator account is the number one target for hackers since it is all powerful
on the computer and it can not be locked out. Renaming the account can give
additional protection against hackers. Also many trojans try a dictionary attack
against the administrator account. --- Steve