Last Updated on December 24, 2022 by Mathew Diekhake

The Windows operating system and the varying accounts it has on offer can be confusing. When you’ve sat down and learned what’s happening with them at least once you quite possibly might not have to do it ever again. All versions of the Windows operating system to date have had these same user accounts available, and there are no signs of it changing anytime soon—it is one of the things that Windows developers did correctly right from the get-go.

There are three types of user accounts that you need to know about. They are the following:

Standard User Accounts. The standard user account is the ‘normal’ account for most people to use. It comes with certain restrictions that won’t allow for the modification of important files, that, in turn, puts a stop to standard user accounts from being able to make changes that would affect other user accounts on the computer or even the computers health in general. That’s not to say that a standard user account can’t create havoc—they can still pick up a ‘virus’ and cause the computer problems, but those problems won’t originate from anything to do with the Windows operating system itself—a standard user account holder might still pick up a virus from using a web browser for example.

Administrator Accounts. The administrator’s account is the first account set up on the computer. It needs to be an account that has the administrative permissions assigned to it by default so that person can do all the things that Windows can do—like installing software or making system-wide changes—or else the operating system would prove pretty pointless. The first admin account can assign those same admin permissions to other user accounts that are created after it, but no other account can give itself admin permissions. A computer can have as many admin accounts created as desired and they all share the same permissions. But be careful who you assign admin rights to—the admin can remove your admin account if they want to, even if theirs was created after yours.

Built-in Administrator Accounts. The built-in administrator’s account has full administrative permissions on the computer. The difference between it and the other admin account is that user accounts with built-in admin permissions do not get prompted by User Account Control. That can make the Windows operating system experience more efficient for people using it but also more vulnerable. You should only use this type of account when you really need and then go back to using the other admin account because it is the other account that offers better security due to UAC.

Enable/Disable Built-in Elevated Administrator Account using Command Prompt in Windows 7

1. You can also enable and disable the elevated administrators account by using the Command Prompt in all versions and editions of the Windows 7 operating system—in other words, it does not exclude the Windows 7 Home and Windows 7 Home Premium does like the other two methods. To get started, open up the elevated version of the Command Prompt by heading to the Start menu > Accessories > CMD > Right-click and choose to run it as the administrator—you’ll now have the elevated version of the Command prompt window open, which means the same thing as the Command Prompt with administrative permissions.

To Disable Built-in Administrators Account Currently Hidden: Type the net user administrator /active:no command into the command line and then press the Enter key on your keyboard to execute the command.

To Enable Built-in Administrators Account Currently Hidden: Type the net user administrator /active:yes command into the command line and then press the Enter key on your keyboard to execute the command.

Built-in Administrators Account Currently Hidden with Password: Type the net user administrator password /active:yes command into the command line and then press the Enter key on your keyboard to execute the command.

All that’s left to do now is close the Command Prompt window by clicking on the X in the top right corner and then restart the computer for the changes to take effect. You might not see any changes without rebooting, or at the very least, logging off and back in to the same account again.

Enable/Disable Built-in Elevated Administrator Account using Local Users and Groups in Windows 7

1. You can enable and disable the built-in administrators account by using the Local Users and Groups in Windows 7 provided you have Windows 7 Professions, Windows 7 Ultimate or Windows 7 Enterprise. It will not work if you have Windows 7 Home or Windows 7 Home Premium. To do that, open the Local Users and Groups manager by navigating to the Run dialog box (Windows logo + R keys) and then typing lusrmgr.msc and pressing the Enter key on your keyboard.

2. Click on the Users folder from the left pane of Local Users and Groups. You’ll now see the different users who have accounts on the computer available from the middle column still within the Local Users and Groups.

3. Right-click on the one that says Administrators and then select the Properties from the menu. You’ll now find the Administrators Properties dialog box open.

4. Keep it on the General tab of the dialog box and then make your selection based on the following:

To Disable Built-in Elevated Administrator Account: Select the Account is disabled checkbox so that it has a checkmark in it and then click on the OK button at the bottom of the window.

To Enable Built-in Elevated Administrator Account: Deselect the Account is disabled so there is no longer a checkmark in its checkbox and then click on the OK button.

5. You’ll notice the bottom of this particular dialog box has both the OK and Apply buttons. You don’t need to click on the Apply button for the changes to be applied. That button is just if you wanted to apply the changes without having to close the window so you can see them in action. The OK button applies the changes as well but also closes the dialog box, so it’s the most efficient way of doing things if you don’t want to keep the dialog open.

Enable/Disable Built-in Elevated Administrator Account using Local Security Policy in Windows 7

1. It’s also possible to enable or disable the elevated administrators account in Windows 7 by using the Local Security Policy if you want. A Security Policy is not available in Windows 7 Home or Windows 7 Home Premium, so you’ll need to have either of the Windows 7 Professional, Windows 7 Ultimate or Windows 7 Enterprise editions to continue. To get started, open up the Local Security Policy by opening the Run dialog box (Windows logo key + R) and then type secpol.msc into the available field and press the OK button.

2. You’ll now have the Local Security Policy window open. Click on the Local Policies in the left pane to expand it and then click on the Security Options folder, still in the left pane once again.

3. Now turn your attention to the right side pane and right-click on the Accounts: Administrator account status entry and select Properties from the menu.

To Disable Built-in Administrators Account: Keep it on the Local Security Settings tab and select the Disable checkbox and click on the OK button at the bottom of the Accounts: Administrator account status dialog box.

To Enable Built-in Administrators Account: Keep it on the Local Security Settings tab and select the Enabled checkbox and click on the OK button at the bottom of the Accounts: Administrator account status dialog box.

You may now close the dialog box by clicking on the X in the top right corner and then close the Local Security Policy window using the X in the top right corner of that window as well.

What User Account Control Means to Windows

Even that of a virus is limited in the amount of a damage it can do when picked up while using a standard user account due to the accounts restrictions working in one’s favor to help eliminate where the virus itself can travel—there are fences in the way preventing malware from running rampant when it is downloaded with a standard user account, and there’s nothing the virus or malware can do to jump them or bring them down. Thus, the standard or unelevated user accounts should always be used unless you have a reason to assign that user the full, built-in administrative rights. According to some fairly reliable reports online, that have been written by some of the larger tech sites in the world but are not necessarily worldwide statistics, around 92% of vulnerabilities reported by Microsoft perceived being as of a critical rating could have been made less severe if the admin rights were revoked from that account. Those reports are going to likely be misunderstood. Windows 7 comes with UAC (User Account Control) which prompts the user to click a Yes button before any critical changes can be made to a system. The standard admin account with User Account Control is far more secure than using the built-in administrators account that does not have User Account Control. Those reports are likely to be talking about computers not using User Account Control, but that rarely happens. When everyday people use the Windows operating system, they either use the standard user account or just the administrators account with UAC.

Malware and computer programs don’t have the chance to press buttons, which is why UAC is so effective, and there’s no real way around that. You might also notice some websites out there get you to click the buttons of the pictures for antispam verification reason—it’s a similar thing where they do it because it isn’t possible for a robot to click those required buttons. You can read more about understanding User Account Control from the Microsoft website.

Windows 10 User Account Changes

Windows 10 brought with it a new feature where you can add family or just other people as user accounts. These accounts are not directly related to accounts that are standard user accounts or admin accounts. You can assign family members and other people to be both standard users or administrators when you set up those types of accounts. The inclusion of the family accounts was so that you could take other people under your wing and then change what they can get access to on your computer—primarily if you wanted to add your child or children to your computer, you can add them as family and set up restrictions to there computer use a lot easier than if you were to try to do it from each web browser they go and use. If you don’t have children or don’t have any reservations to restrict other people’s user account permissions on your computer, then you don’t need to worry about setting them up as family members—even if they are your real family you don’t get in trouble if you don’t add them as family members. Most people just add other users, whether they are friends, family or acquaintances, as other standard users.

Related Tutorials