Deleting the admin account? Thoughts

I've seen various posts and times about people recommending the deletion of the (or changing the name of) the Administrator account to give crackers and hackers a harder time at system penetration through the login. However, I would like to discuss this much further. I can see how changing the default Administrator may buy you time while they search for the admin's new login name, but what also understand is that the deletion or change of the administrator account can have negative impacts upon the system. I see it as an "unknown" variable, in which you won't ever really know if functionality is limited behind the screens on certain programs, because they require a check for the term Administrator on the login.

recovery console (on XP based systems) will prove to be incapable of functioning because it requires the "Administrator". Without it, you can't repair disk sectors, master boot records, drive functionality, and so forth and so forth. You cripple one of the strongest recovery tools in the XP distro.

This applies to certain other version of Windows as well as some programs running on them. So, while it may buy you a few days for them to discover the newer login name, is it work the risk of breaking compatability with software, recovery methods, and general "I don't know for fact or certainty that nothing unexpected will happen on my system due to the name change of a primary OS login, so it's safer to not do it".

Thoughts?

I generally just set a strong password or passphrase on it. I don't know about changing the name but I don't think I would ever delete the account. I'm sure changing the name has the same effect though. On the other hand, I've experienced on windows that if you try and change a username, it makes almost an alias and keeps the other user stuff. So you can still login with both. That was for my account, but I don't know if it also holds true for the admin account. If that's the case, changing the name gets you nothing. So I guess if it's up to me just throw a strong passphrase on the admin account and pray. Really they should never get to where they have the opporitunity to input a username and password.

AFAIK, you can't delete the administrator account anyways and even with a rename (simply security through obscurity), it can be found. Tools like SID2USER and USER2SID (I think that's what they are called) can help with this.

That said, I don't think it can be done since there are so many tasks that require admin specifically (GID 500 that is). It'd be like deleting root on a *nix box. I can't imagine that one would be able to do it since even booting requires root.

MsMittens: Ah, just noticed that. Looked into it a bit more and it turns out they can only be renamed, but not deleted. This does change things since it may in fact keep the term Administrator
but not the login, as h3r3tic pointed out. So.. now brings the question:


Are there any side effects to renaming the administrator account to something else? Does recovery still work? Any program incompatabilities? I'd love to test, but I've got far too much number crunching on this computer right now.

Quote:

---

Really they should never get to where they have the opporitunity to input a username and password.

---

No, I agree. But we aren't talking about local or remote security overall, just this theory :)

AFAIK, there are no side effects since I would think most programs look for the SID/GID information if they need something to run. I know (as I've seen this) if the SID/GID gets corrupted for whatever reason, you are screwed (read: rebuild yer box). That would lead me to believe that a rename is no different than just changing root to toor.

At least with the programs I've used I never had problems. Doesn't mean that someone didn't write a program that looks specifically for the name Administrator.

Quote:

---

Originally posted here by pooh sun tzu

System restore from the console (on XP based systems) will prove to be incapable of functioning because it requires the "Administrator". Without it, you can't repair disk sectors, master boot records, drive functionality, and so forth and so forth. You cripple one of the strongest recovery tools in the XP distro.
Thoughts?

---

I ran into this a while ago and while trying different things put in a 2k disc.
(This was way before the "vulnerability" for this was released... I posted on it...)

You can use the 2K recovery console...
It bypasses the registry and authentication and gives you full access to the filesystem.

I regularly rename or disable the admin account. If I need that account... I can reinstall or reimage the machine. There is no need for the local admin account when your domain admin account will do the same thing... (well.. unless you're on a different IP scheme...) but there are still solutions for that. Put in a router and "fake" your WAN to the authentication servers...

I don't rename or disable it on home machines though... just on work machines.

If a home box gets compromised... big deal (IMO). Thats a lot easier to deal with.

And MSM is right... it doesn't even matter if you do rename the admin account... it can be found out pretty easily.

I'd like to know if you DO change the Admin account name, would you be able to change it BACK to 'administrator' as and when required ?

I've read about changing names etc, but I've never really grasped whether you were supposed to change and leave it, or change it back ...............

As you can change the admin account through setting security policy (or domain-based group policy), it's straightforward to rename the account without any ill-effects, and change the name later.

The only problems i've seen are related to older applications that rely on the currently logged in user being "Administrator" before they'll install...but that's rare.

I think it's a good idea to rename the administrator account. The SID does not change so
recovery console and tools still work. You are prompted for the administrator password only
and the renamed account password will still work.

I change the account not to create road-blocks for human crackers as much as for
the many worms running around that attempt to brute-force accounts named administrator.

I have never seen any loss of functionality due to renaming the original administrator account.

The word administrator is simply an easy to remember name like a dns name masking the actual
account identification information.

Are you sure that system restore is not meaning administrator in the logical sense as
the recovery console does? I disable restore and have not used it.

Although I'm sure it's been done, any software needing the account "administrator" to function
would be poorly written and not worth using IMO.

The notion of buying time can have limited value.

I believe that risk management does allow for "unknown" variables as I don't think it possible
to be certain that all is known. The line must be drawn somewhere and I suppose where each of us draws that line would be debated to no end..??

Quote:

---

Are you sure that system restore is not meaning administrator in the logical sense as
the recovery console does?

---

My mistake :) I meant recovery console not system recovery. Changed it in the parent post. Thanks!

I'll follow the ss2chef here. The name "Administrator" is just a name that easier to remind that a SID. If you find a program that doesn’t work because the “administrator” name is required, it’s because the software provider doesn’t follow Windows API. I never play with Recovery Console but I think it would suck if the recovery console doesn’t work because the administrator login is change!

Yeah, you can rename the Adminstrator account to anything you like through the LSP in Win2k as has been said. In Win XP Pro you can rename it through My Computer - Manage. As has also been said the SUID will remain 500 so anyone looking with SID2User or User2SID will see the true admin account because of it's 500 SUID.

I'll make a couple of thoughts here.....

If I can use the User/SID tools I'm far too close to rooting the network anyway for a renamed Administrator account to be "scarey". If you've allowed the attacker this close and not noticed then you will probably be rooted soon.

I like renaming the Administrator account on machines that are publicly available. Then I make a new account called Administrator. If some attempts to brute force the administrator account remotely then it falls under the account lockout policy, which the 500 SUID doesn't. I can then be alerted on an account lockout on the box.... It's quicker and easier than looking for mass attempts in a brute force attack on the 500 account. The lockout policy is for 3 days so the attcker is really screwed. Additionally, and because I am a little bit evil, I deny access to the entire C: drive to the new Administrator so even if they get really lucky they can't do a darned thing..... ;)

Does all that tell them in no uncertain terms that the account they are attacking isn't the 500 SUID?.... Of course.... but I don't give a monkeys..... Once they realize that I have gone to that length to piss with them they have to know that brute forcing the username of the 500 account is useless.... Yes, it's more like a password than an account name.... And you can forget brute forcing the password in my lifetime... I use the entire character set including the extended ASCII......

Finally, I have yet to have any issues with a renamed Administrator account... but that's more because "Administrator" is just a name..... The account is still the 500 SUID and that's what's used for authentication and the granting of rights and permissions.

When I had to use the recovery console... I knew the admin password... but it wouldn't let me logon... it kept asking for "administrator" password... and I had renamed the user account...

I'll have to see if that still doesn't work... last time I tried... I was unable to use the XP recovery console with the administrator account renamed...

Am I just going crazy?

Phish:

I never used the recovery console on a machine with a renamed Administrator account but I would suggest that is it requires the name administrator rather than acting properly, (per the protocols used in day to day management), then this would be a flaw.... Not a serious flaw in terms of security, but certainly the fact that it doesn't operate on the SUID system is a probem.... But this is why we image our disks isn't it? ;)

you wouldnt change the administrator username if you are on a standalone machine with many people login on to it. however, on a network, you would change the domains administrator username. doing it this way doesnt harm recovery etc, as the LOCAL machine admin is still administrator. however, someone trying to attack a network has to search for the admin username you changed to get access to the network.

cheers,

Hey, I want to take a look at that --

So you're saying it's a good idea to leave the local admin username in place, but change the domain admin username. That sounds promising, and is something I've been thinking about for our network in addition to shifting from passwords to passphrases.

Anyone else care to expound upon that thought?

yeah AngelicKnight,

i work at a school with a medium-size (i spose) network of 240 computers (and high school kids). we basic dont care about the local machines, if they bugger up, we just ghost them and to connect to the domain we login as 'administrator' locally. however, the domain admin username we changed... it is so good to have. we search logs, and the ammount of "attacks" (used VERY loosely) by kids is at the "administrator" account.

muwahahah :P

Even though this particular article only applies to Win2k it says that the recovery console shows you that it is logging into the administrative account even if the name has been changed. It's just the the prompt doesn't show you what name you changed it to. It will still let you login. I've never seen anything that indicates that WinXP behaves differently.

http://support.microsoft.com/default...b;en-us;258585

In over 10 years of using NT I've never had any problems from changing the administrative account to another name. If you disable netbios, it will be rather hard for an attacker to determine what the name of the account is if they don't have any type of access to the machine. If you have a piece of software that relies on an account called administrator being there to function I wouldn't use that software.

I never leave any accout called administrator with any type of administrative privileges.. Whether that is domain, or local system privileges.. All default administrator accounts are renamed, and new accounts are delegated the proper permissions.

Many people have this problem with the recovery console and think it is because the account was renamed-
http://support.microsoft.com/default...b;en-us;308402

We renamed the enterprise admin account a long time ago. Then applied a very random, long and complex password to it and locked it in a safe--just in case we have to recover the forest. Then we just don't use it. We really should change the password on this account periodically, though. However, we rename the thing again every now and then. Just to keep things interesting. We use two accounts. A personal one and an SA account. The personal is a normal account. The SA account is the one used to manage and make changes. Audit trail, you know.

Yeah, the security by obscurity thing is the only reason for changing the local admin, or domain admin account names. It just makes it harder to write scripts that attack normal admin account names. Smart scripters will use LDAP or other methods to use the SID, which doesn't change.

Your best bet is to create a good, long, complex password and then don't use the account, especially in a remote session.