Enable Administrator, but hide from logon window

[Chris Barnes]

First question: why is the Administrator account disabled in Vista
(Enterprise 64, if that matters)?

As a general SOP for folks in my dept, when they get a new computer (for
their office), I set their userid to have Administrator privs and set
the passwd for the default Admin account to something I know. That way,
they can do whatever they want with their machine, but I can still get
in to fix things if needed.

Iow, having the Administrator account active is important to me.



2nd question, is there a way to hide the Administrator account (if I
enable it) from the default logon screen? And yes, I know I can
change how users logon by disabling the Welcome screen - that is *not*
what I want to do.


3rd question, related to the 2nd: assuming I can hide the account from
the Welcome screen, apparently I can no longer Cnt-Alt-Del to get a
regular logon screen. Is this just disabled, or is it gone completely?

 

[Bruce Chambers]

First question: why is the Administrator account disabled in Vista
(Enterprise 64, if that matters)?

I believe it's the same for all Vista versions; and it's a basic
security precaution. The first user account created on the new machines
will have administrative privileges, by default.

As a general SOP for folks in my dept, when they get a new computer (for
their office), I set their userid to have Administrator privs ....

Not somethiong normally done, but if you've a lot of time on your hands
to clean up after them, it's certainly your choice.

.... and set
the passwd for the default Admin account to something I know. That way,
they can do whatever they want with their machine, but I can still get
in to fix things if needed.

Iow, having the Administrator account active is important to me.

So, enable it as you prep/install the new workstations.

2nd question, is there a way to hide the Administrator account (if I
enable it) from the default logon screen? And yes, I know I can
change how users logon by disabling the Welcome screen - that is *not*
what I want to do.

WEhat would be the point? After all, you've already given your user
administrative privileges, so they can alter anything they like,
including the settings/password for the built-in Administrator account.




--

Bruce Chambers

Help us help you:



They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety. -Benjamin Franklin

Many people would rather die than think; in fact, most do. -Bertrand Russell

 

[Chris Barnes]

Not somethiong normally done, but if you've a lot of time on your hands
to clean up after them, it's certainly your choice.

Higher Educational sites tend to have professors who *demand* more
autonomy than typical corporate settings. What they do in their offices
and/or research labs is under their control - I am only an "adviser".
Thus far I've gotten most of them to hold off on Vista, but a few brave
souls are taking the plunge. Then again, fully 1/3 of them use OSX,
another 1/4 use Linux. The rest use some form of Windows of one flavor
or another (including some old die-hards who still hang onto Win98!).

So, enable it as you prep/install the new workstations.

Yeah - that's easy enough.
BUT... I don't want it to show up, as related to the question(s) below).

What would be the point? After all, you've already given your user
administrative privileges, so they can alter anything they like,
including the settings/password for the built-in Administrator account.

They don't need to SEE my account.
This isn't hiding information from them (they know I have the Admin
account).


Look, this isn't asking for the moon. This was the default behavior in
WinXP (and for that matter, Win2k). I'm just asking to make things
behave the same way they used to. Surely this can't be *that* hard,
can it?

 

[Chad Harris]

Hi Chris--

1) As to the Admin account in Vista 64--it was MSFT's UAC team's move for
security to run default standard but you can change it.

http://blogs.msdn.com/windowsvistasecurity/

SYMPTOMS
You notice that the administrator account does not appear on the Windows
Vista Welcome screen.
Back to the top

CAUSE
By default, the following conditions are true in Windows Vista:. The
built-in administrator account is disabled.
.. The built-in administrator account cannot log on to the computer in safe
mode.
Note In some cases, Windows Vista may determine, during an upgrade from
Microsoft Windows XP, that the built-in administrator account is the only
active local administrator account. In this situation, Windows Vista leaves
the built-in administrator account enabled. Additionally, Windows Vista puts
this account into Admin Approval mode.

The administrator account does not appear on the Windows Vista Welcome
screen
http://support.microsoft.com/kb/926183

http://windowshelp.microsoft.com/Windows/en-US/Help/74603287-0ee9-4470-9a4e-3d791f95f4c61033.mspx

You can type contol userpasswords2 in run box and turn on the account.

2) You want to hide the admin account from the default login screen:

This comes from Ronnie Vernon, MVP:

You can hide accounts the same way you did in XP, but in Vista you need to
create those registry keys.

In regedit, navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Right click Winlogon and select New / Key

Name the new key SpecialAccounts (case sensitive)

Right click The SpecialAccounts key and select New Key again.

Name the key UserList

Click the UserList key and in the right side window right click and select
New / DWord (32bit) Value.

Name the new DWord value the same name as the account you wish to hide.
Double click this value and in the Value Data line enter either 0 (zero) to
hide the account or 1 to show the account.

**WARNING: Make sure that you have at least one Administrator account
available on the Welcome screen! If you hide the last administrator account
you may lock yourself out of making any changes that require administrator
privileges! Vista is designed to reveal the built-in administrator account
when you log into safe mode, if no other administrator accounts are
available, but if an administrator account is simply hidden, then the
built-in administrator account will not show up in safe mode!**

3) I belive this is what you want Chris:

Type control userpasswords 2 in the run box>advanced tab>require users to
press Ctrl+Alt+Delete

Good luck hth,

CH

 

[Chad Harris]

If these guys are educators at the college or higher level, I don't think
there is much bravery involved in taking the Vista plunge. I know a lot of
kids average age 15 who are at the advanced level in many Linux setups,
Vista, and MSFT servers Chris. Many of them help on the newsgroups. If
they can do it these guys who are profs can hack it too.

I hope any of what I gave you in the first post helps.

CH

 

[Chris Barnes]

Excellent answer. Thank you very much.