Ask your problem

Microsoft has hidden the Administrator account in Vista, but it's easy to resurrect once you know how to find it.

You won't find the Administrator account in the User Accounts Control Panel. But the MMC-based Computer Management section of the Administrative Tools Control Panel does give you access to the Administrator account. By default, the account is disabled, but you can enable it there. Your obvious conclusion might be that all you need to do is enable the Administrator account, restart Windows and then log into the Administrator account. But that doesn't work. There's an added step that Microsoft hasn't documented and that isn't all that intuitive: Not only do you have to enable the Administrator account, you also have to disable all other accounts with computer-administrator privileges. And since Vista's clean-install setup program forces you to create a new user account with computer administrator privileges, everyone has to cross this hurdle in finding the built-in Administrator.

Before you take any steps to reveal Administrator on your computer, please be aware that there's a bug in Vista Beta 2 that can cause you serious woe if you create a password for your Administrator account in Computer Management. The result of the bug is that you will be completely locked out of your Windows Vista installation. So, please follow the directions to the letter. I will show you how to safely add a password to your Administrator account.

Start by booting your computer to Vista in your computer administrator account. Open the Administrative Tools Control Panel. Double-click the Computer Management item to open it. Authorize UAC by clicking the Continue button. Double-click "Local Users and Groups" to open it. Click the Users folder. On the right side of Computer Management, you should see icons for all of the user accounts created on your computer. The ones that have small red circles with an "X" through them are disabled.

Click to select the Administrator icon, and then right-click it to open its context menu and choose Properties. Remove the check mark from the "Account Is Disabled" box and click OK. You'll need to restart your computer and follow one of the following two methods to access Administrator.

Accessing Administrator: Method 1

For this method, you press F8 as Windows is starting up when the character mode part of the boot-up says something to the effect of "Starting Windows. ..." In a dual-boot environment, you can do that from the boot menu. Once the boot menu is showing, paused for your operating system selection, use the arrow or tab keys to select "Microsoft Windows" (the option that runs Windows Vista). Don't press Enter; instead, press the F8 key, and you'll progress to the Safe Mode boot screen. Choose the first option, "Safe Mode" and press Enter.

After a time, Vista will show you the log-in screen with two options, Administrator and Other User. Click the Administrator icon.

Running Safe Mode as Administrator both limits and extends your privileges. But for quick access to the Administrator account, this is about as good as it gets in Vista Beta 2.

Accessing Administrator: Method 2

The second method allows you to log into the Administrator account just as you would any normal account. So you get the full-fledged Administrator privileges in a normal boot mode, not Safe Mode. There's a trick you need to know to make it work. And also something you need to watch out for.

Start by enabling the Administrator account in Computer Management just as described above. (Remember: Don't set a password in Computer Management for the Administrator account.)

The second step -- the trick -- is to disable any other enabled accounts with computer administrator privileges in the Users area. Look for account icons that lack the red disable mark. You should find at least one with computer administrator privileges. Follow the same steps to open Properties, but this time, click to add a check mark in the box labeled "Account Is Disabled."

Double check that your Administrator account is enabled. Close Computer Management and restart Windows. When it comes back up, it will just load the Administrator account, since you haven't set a password.

For security reasons, this method should only be used on a temporary basis. Your Administrator account should not be left enabled without a password. So, have a look around, but don't move in. And when you're done, I strongly urge you to re-enable your user account(s) and promptly disable the Administrator account.

If your goal in accessing the Administrator account is to ditch User Account Controls, a somewhat safer way to do that would be to stick with your account with computer-administrator privileges (the one that is not named Administrator). Open the User Account Control Panel. Click the link there that reads "Change security settings" (in Vista Beta 2) and "Turn User Account Control on or off" (in Build 5472 and beyond). On the subsequent screen, you'll find an easy way to turn off UAC.

Living Dangerously

There is another possible wrinkle on Method 2. It is possible to set a password for your Administrator account. The bug with setting the Administrator account is in the Computer Management part of the Administrative Tools Control Panel. But there's another way to manage user accounts: the User Accounts Control Panel.

User Accounts doesn't display any settings for the Administrator account until you're booted into that account. But once you're booted into Administrator, it lets you set a password for it without any negative effects. So this is a work-around if you'd like to leave your Administrator account enabled. Enable it in Computer Management, and then set a password for it in the User Accounts Control Panel. It's important to protect it with a password that's not easy to guess or arrive at by trial and error.

Conclusions

Despite what it may seem to some people, Microsoft's decision to disable and lightly hide the Administrator account in Windows was a very good one. Millions of people have for many years been living in this account -- many without even having set a password for it. Doing so makes it easy for malware and hackers to waltz into an account that has unlimited access to the operating system. By changing the name for the account on your computer that has administrative privileges, and by setting a password for it, Windows security is raised considerably.

The user experience for dealing with User Account Control elevations, although improved in Windows Vista Post-Beta-2 Build 5472, is still a little rough. Microsoft has designed UAC in a way that keeps you from having to reboot between changes, but there are still too many nuisance UAC prompts. There's still development time to go on Vista's User Account Controls.

Online editorial director Scot Finnie has been an editor for a variety of IT publications for more than 20 years. This article was adapted from the July 2006 issue of Scot's Newsletter and is used by permission.

0 Comments:

Post a Comment