Using only the built-in Administrator account for all management tasks is risky. Creating a dedicated administrative user — and eventually restricting or renaming the default Administrator account — is a core Windows Server security practice.
Prerequisites
- Windows Server VPS with Administrator access
Method 1 — Using Server Manager (GUI)
- Open Server Manager → Tools → Computer Management
- Navigate to Local Users and Groups → Users
- Right-click and select New User
- Enter a username and strong password; uncheck "User must change password at next logon" only if you plan to set it yourself immediately
- Click Create
Method 2 — Using PowerShell (Faster)
$Password = Read-Host -AsSecureString "Enter Password"
New-LocalUser "deploy" -Password $Password -FullName "Deploy Admin" -Description "Administrative account"Step 2 — Add the User to the Administrators Group
GUI: In Computer Management, right-click the new user → Properties → Member Of → Add → type Administrators.
PowerShell:
Add-LocalGroupMember -Group "Administrators" -Member "deploy"Step 3 — Test the New Account
Log out and log back in with the new account to confirm it has administrative access (you should see UAC prompts working correctly for privileged actions).
Step 4 — Rename the Default Administrator Account (Recommended)
Attackers commonly target the exact username "Administrator." Renaming it adds a small but meaningful layer of obscurity:
Rename-LocalUser -Name "Administrator" -NewName "svc-admin-primary"Step 5 — Optionally Disable the Default Administrator Account
Only after confirming your new administrative account works correctly:
Disable-LocalUser -Name "svc-admin-primary"Viewing All Local Users
Get-LocalUserViewing Members of the Administrators Group
Get-LocalGroupMember -Group "Administrators"Removing Administrative Privileges from a User
Remove-LocalGroupMember -Group "Administrators" -Member "username"Common Errors
"Access is denied" running these commands — ensure PowerShell is running as Administrator (right-click → Run as Administrator).
New user can't perform admin tasks despite group membership — log out and back in fully; group membership changes require a new session to take effect.
Best Practices
- Never disable the default Administrator account until a working replacement is fully tested
- Use unique, strong passwords for every administrative account
- Limit the number of accounts with full Administrator privileges
FAQ
Should I ever fully delete the built-in Administrator account?
Generally no — renaming and/or disabling it is safer than deletion, since it's a protected system account with special recovery properties.
Related Articles
- How to Secure RDP on a Windows VPS
- How to Connect to a Windows VPS via Remote Desktop (RDP)
- How to Configure Windows Firewall on a Windows VPS
