Protecting the Administrator Account

Windows 2000's built-in Administrator account needs special protection against attacks because of several idiosyncrasies that Win2K inherited from Windows NT. Each Win2K Professional workstation and Win2K member server (e.g., not a domain controller—DC) has a local SAM database that always contains at least two user accounts: Administrator and Guest. Both of these accounts are potential targets for intruders, and you can't delete either account. Although Win2K disables the Guest account by default, which reduces the associated risk as long as you keep this account disabled, the Administrator account is different. For example, even though you can specify an account lockout policy for the local system using the Local Security Policy Microsoft Management Console (MMC) snap-in, Win2K ignores this policy for the Administrator account. In other words, you can't lock out the Administrator account no matter how many times you try to log on.

According to Win2K’s Help text, Microsoft made these exceptions so "that you never lock yourself out of the computer by deleting or disabling all the administrative accounts." Although this decision sprang from good intentions for inexperienced or careless users, it leaves serious security administrators who need to harden systems out in the cold. Attackers know that the Administrator account exists; that this account must be enabled; that it is all powerful; and that no matter how long they pound on this account with password guesses, it won’t lock out. . . .