It is best practice that the local Administrator account is disabled due to several known vulnerabilities:

1. The built-in administrator account cannot be locked out no matter how many failed logons it accrues, making it a prime target for brute-force attacks that attempt to guess passwords.
2. The account has a well-known security identifier (SID), and many non-Microsoft tools allow authentication by using only the SID rather than the account name. Therefore, even if you rename the Administrator account, an attacker could launch a brute-force attack by using the SID to log on.

All other accounts that are members of the Administrator's group have the safeguard of locking out the account if the number of failed logins exceeds its configured maximum.