Windows 10 October Update Can Now Disable Your Administrator Account

[jammiescone]

Source: https://www.eteknix.com/windows-10-october-update-may-ruin-admin-account/?fbclid=IwAR1etKL1YiWwgzVF9t1hAX8TihPk27RAfPfD50NdTqACZc7lTwE1SqnbZb8

 

It looks like the Windows 10 October Update is not out of the woods yet with new bugs still rearing their heads. 

 

This time, it's being reported that under a specific set of conditions, the default Administrator account can end up being invalidated after upgrading from 1803 to 1809. According to the reports, originally from GHacks:

 

Quote

The bug occurs when the following two conditions are met:

• The built-in Administrator account is enabled (it is disabled by default).
• There is at least one additional account with Administrator permissions.

 

The biggest thing for me on this is that Microsoft's recommended fix is that you either:

• Create a separate account with admin privileges BEFORE installing the update, to use going forward, or;
• Avoid meeting the criteria

Neither of these feel like real solutions to me, and there is no advice offered for anyone who might already be in this position. 

 

I can't imagine this having too much of a drastic effect for most people, but it's just another issue to add to a long line of issues, and I'm not a big fan of Microsoft's response.

 

Anyone here who uses the default administrator account and could be affected by this?

 

[Brooksie359]

You're holding it wrong. I mean you are updating it wrong...

[jammiescone]

2 minutes ago, VegetableStu said:

wait, when windows installs for the first time, they'll ask the user to create an account. is that a "system" admin account or a user admin account? o_o

That's a user admin account. These days the default system admin account has to be enabled manually, usually for a specific purpose, hence I don't see it affecting too many people overall!

[leadeater]

16 minutes ago, jammiescone said:

The biggest thing for me on this is that Microsoft's recommended fix is that you either:

• Create a separate account with admin privileges BEFORE installing the update, to use going forward, or;
• Avoid meeting the criteria

Neither of these feel like real solutions to me, and there is no advice offered for anyone who might already be in this position. 

To be slightly fair current best practice is to leave the Administrator account disabled and never use it. You should actually use a different administrator privileged account instead, I have done this for years now. There is a good reason for this, it's a known account that attackers can try and exploit or brute force the password. If you don't know the username of the administrator privileged account brute forcing the password is a heck of a lot harder.

[mynameisjuan]

1 minute ago, leadeater said:

To be slightly fair current best practice is to leave the Administrator account disabled and never use it. You should actually use a different administrator privileged account instead, I have done this for years now. There is a good reason for this, it's a known account that attacks can try and exploit or brute force the password. If you don't know the username of the administrator privileged account brute forcing the password is a heck of a lot harder.

Exactly and this applies for all OSes as well. 

[BurnedPriest]

I love how the title is formulated like this is a new Windows feature.

[jammiescone]

1 minute ago, leadeater said:

To be slightly fair current best practice is to leave the Administrator account disabled and never use it. You should actually use a different administrator privileged account instead, I have done this for years now. There is a good reason for this, it's a known account that attacks can try and exploit or brute force the password. If you don't know the username of the administrator privileged account brute forcing the password is a heck of a lot harder.

A fair point, I think most people probably go about things the same way now. I do know a fair few people though who do enable it periodically for serious troubleshooting, particularly if having issues with a specific user account.

[jammiescone]

1 minute ago, BurnedPriest said:

I love how the title is formulated like this is a new Windows feature.

New from Microsoft: Slightly-less-functional-than-before-Windows 10 1809 (SP36)

[GoodBytes]

To clarify, it is talking about the account with the user name called: "Administrator". This account is disabled by default and should never be used. It is there in case of emergency (example, your account, the only account, is corrupted, and you can't create a new account because something else is broken... you have this Admin account that you can unlock and use).

 

Some people enabled it, because they are used to old ways from Windows XP and prior versions of Windows where the main account is called "Administrator".

 

Seeing that it says that in order for the Administrator account to be locked after you update, you need to have another account with admin privileges. Sounds like to me, it was done on purpose. Not only the Administrator account is disabled by default, but based on what is being said, a check was added in order to know if "Administrator" should be disabled or not.

[jammiescone]

12 minutes ago, GoodBytes said:

Seeing that it says that in order for the Administrator account to be locked after you update, you need to have another account with admin privileges. Sounds like to me, it was done on purpose. Not only the Administrator account is disabled by default, but based on what is being said, a check was added in order to know if "Administrator" should be disabled or not.

I'm not sure it was intentional, because I think Microsoft knows that there are still sysadmins out there who use it responsibly when it's required. It will be an accidental security improvement for regular users who had it activated without knowing, but I don't reckon there's many of those around since it's not something you can really enable by accident! More likely to just cause minor headaches for those using it as a last resort tool!

[Ja50n]

Linux gaming performance just needs to get a little bit better, then I can ditch Windows for good...

[Doobeedoo]

So just use a user admin acc and not default system built-in one then yes. 

People, it's all about security ok xd

[Mira Yurizaki]

1 hour ago, jammiescone said:

I'm not sure it was intentional, because I think Microsoft knows that there are still sysadmins out there who use it responsibly when it's required. It will be an accidental security improvement for regular users who had it activated without knowing, but I don't reckon there's many of those around since it's not something you can really enable by accident! More likely to just cause minor headaches for those using it as a last resort tool!

Given when Vista ran all programs with standard user privileges by default and broke programs that expected admin rights (for no real reason) to just be there and failed in ways that made it non-obvious it wanted admin rights, I think those people would have more than just a minor headache.

[BuckGup]

1 hour ago, leadeater said:

To be slightly fair current best practice is to leave the Administrator account disabled and never use it. You should actually use a different administrator privileged account instead, I have done this for years now. There is a good reason for this, it's a known account that attackers can try and exploit or brute force the password. If you don't know the username of the administrator privileged account brute forcing the password is a heck of a lot harder.

It's like being root the whole time in linux

[Brooksie359]

2 hours ago, leadeater said:

To be slightly fair current best practice is to leave the Administrator account disabled and never use it. You should actually use a different administrator privileged account instead, I have done this for years now. There is a good reason for this, it's a known account that attackers can try and exploit or brute force the password. If you don't know the username of the administrator privileged account brute forcing the password is a heck of a lot harder.

So we are using Windows wrong?

[samcool55]

48 minutes ago, BuckGup said:

It's like being root the whole time in linux

Being root all the time is a bit silly, i get that.

But root is still enabled by default on linux (usually) and you can use/need root privileges for a lot of things.

 

Disabling root so you can't use it at all is a really bad idea in most cases. I get that enabling the admin on windows isn't a good idea, but i can see it making sense when you have it enabled and use it only when you need it (run as a different user is a thing soo...).

 

And the annoying bit is that the built-in admin is not the same as an admin you create. As being root allows you to do everything, even if that completely breaks the system. Being a "normal" windows admin however doesn't really give you access to everything which can be REALLY annoying sometimes compared to the built-in admin that still does not give you access to completely break everything in 5 seconds as root does, but it's a step higher than a normal admin.

 

 

[MyName13]

I still haven't received 1809...

[Jito463]

Disabling the built-in Administrator account was surely done on purpose, given that the built-in Administrator account is actually broken in many ways in Windows 10 (and has been since launch), especially when accessing Settings.  Apart from using it to repair broken installs or user profiles, there's really no reason to have it enabled.

[samcool55]

1 minute ago, Jito463 said:

Disabling the built-in Administrator account was surely done on purpose, given that the built-in Administrator account is actually broken in many ways in Windows 10 (and has been since launch), especially when accessing Settings.  Apart from using it to repair broken installs or user profiles, there's really no reason to have it enabled.

Can you give examples of it being broken? I don't use it so i have no clue it's broken, but it's the first time i hear about it.

[Jito463]

1 hour ago, samcool55 said:

Can you give examples of it being broken? I don't use it so i have no clue it's broken, but it's the first time i hear about it.

It's possible this has been fixed, but last I checked the Settings menu wasn't working correctly and neither was the Start menu.  I don't recall the specifics, but I pretty much just accessed PowerShell, did what I needed to and then exited because it wasn't useful beyond that.

[Ashley MLP Fangirl]

i think Microsoft broke a record with 1809... most broken update ever. 

[PlayStation 2]

hasn't been real administrator accounts on windows since xp, don't see what's changed lul

[leadeater]

7 hours ago, Brooksie359 said:

So we are using Windows wrong?

Depends, do you have the curtains open or closed?

[leadeater]

7 hours ago, samcool55 said:

And the annoying bit is that the built-in admin is not the same as an admin you create. As being root allows you to do everything, even if that completely breaks the system. Being a "normal" windows admin however doesn't really give you access to everything which can be REALLY annoying sometimes compared to the built-in admin that still does not give you access to completely break everything in 5 seconds as root does, but it's a step higher than a normal admin.

What does the built-in admin account give you extra? I have never encountered such a thing and being a member of the Administrators group gives you everything you need. It's been years now and I never hit the need to enable and use the built-in administrator account.

[mr moose]

13 hours ago, BurnedPriest said:

I love how the title is formulated like this is a new Windows feature.

 

It makes a refreshing change from the petulant shit dig titles (that are incidental almost always wrong in some way).