(The name of the built-in Administrator account must be changed to something other than 'Administrator' per STIG requirements.)Ĭhange the built-in Administrator account password at least every '60' days.Īutomated tools, such as Microsoft's LAPS, may be used on domain-joined member servers to accomplish this. If the 'PasswordLastSet' date is greater than '60' days old, this is a finding.Įnter 'Net User | Find /i 'Password Last Set'', where is the name of the built-in administrator account. Review the password last set date for the built-in Administrator account.Įnter 'Get-ADUser -Filter * -Properties SID, PasswordLastSet | Where SID -Like '*-500' | Ft Name, SID, PasswordLastSet'. You can now sign out of your current account and sign in to the new administrator account. Now click on your user name in the bottom left and a new ‘Administrator’ account should now be available in this section. Windows Server 2019 Security Technical Implementation Guide Close the local groups manager and activate the Start menu. LAPS will change the password every '30' days by default.

Organizations that use an automated tool, such Microsoft's Local Administrator Password Solution (LAPS), on domain-joined systems can configure this to occur more frequently. Changing the password for the built-in Administrator account on a regular basis will limit its exposure. The built-in Administrator account is not generally used and its password not may be changed as frequently as necessary. The longer a password is in use, the greater the opportunity for someone to gain unauthorized knowledge of the password.

Windows default admin password