Accounts: Local Administrator account should be disabled

822e9bf2-405a-42cb-9566-8532df68939f

It is best practice that the local Administrator account is disabled due to several known vulnerabilities:

  1. The built-in administrator account cannot be locked out no matter how many failed logons it accrues, making it a prime target for brute-force attacks that attempt to guess passwords.
  2. The account has a well-known security identifier (SID), and many non-Microsoft tools allow authentication by using only the SID rather than the account name. Therefore, even if you rename the Administrator account, an attacker could launch a brute-force attack by using the SID to log on.

All other accounts that are members of the Administrator's group have the safeguard of locking out the account if the number of failed logins exceeds its configured maximum.

https://www.stigviewer.com/stig/windows_10/2016-11-03/finding/V-63601


stig-medium-server
stig-medium-desktop
desktop
compliance-server
compliance-desktop
server
security-desktop
security-server