Windows 11: How to enable the built-in Administrator account

To enable the built-in Administrator account in Windows 11, open a Command Prompt or Terminal as an administrator and run net user administrator /active:yes. Then give the account a password, sign out, and pick Administrator on the sign-in screen. The same command works in every edition, Home included, and in Windows 10; on a non-English Windows, the account's name may be translated (Administrador in Spanish), so use that name instead.

Every Windows installation creates a built-in Administrator account, but since Windows Vista, setup disables it and makes your own account a member of the Administrators group instead. Windows 11 still does that. There are several approaches to enable it again. In this article, I'll show you the one that I find easiest and that I've been using for years, since Windows XP, plus a few alternatives.

I'll also cover what to do when the command fails, how to set the password, how to disable the account again, and what to do if you're not an administrator. I took the screenshots on Windows 11 22H2 in September 2023. For this October 2026 update, I checked the commands and settings against Microsoft's documentation as of Windows 11 version 26H2, the current release, without rerunning them on a Windows machine.

The first step is to open a Command Prompt (or a Terminal) with administrator rights.

Press the Start button and type cmd. The Start menu should look like the following picture:

Once the Command Prompt application is listed, click on the Run as administrator option.

Alternatively, right-click the Start button (or press Windows+X) and choose Terminal (Admin). Terminal opens Windows PowerShell by default, and the net user commands in this post work the same in PowerShell as in the Command Prompt.

Before you change anything, you can check the account's current state:

net user administrator

The Account active line of the output says No while the account is disabled.

Then run the following command to enable the built-in Administrator account:

net user administrator /active:yes

The following screenshot shows the successful output of the command:

These are the errors you're most likely to see:

• System error 5 has occurred. Access is denied. The Command Prompt isn't running as administrator. Close it and open it again with Run as administrator.
• The user name could not be found. (error 2221) The account has a different name on your machine. Some languages translate the built-in account's name: on a Spanish installation it's Administrador, so the command is net user administrador /active:yes, while German or Italian installations keep Administrator. An IT department may also have renamed it. Run net user without arguments to list the real account names.
• The password does not meet the password policy requirements. (error 2245) Windows refuses a password, or enabling an account, that breaks the computer's password policy. Set a new password first, as shown below.

If you'd rather not guess the name, Windows PowerShell can find the account by its security identifier (SID), which always ends in -500, whatever the account's name or language:

Get-LocalUser | Where-Object SID -like '*-500' | Enable-LocalUser

Run it from an elevated Windows PowerShell or Terminal (Admin). Get-LocalUser and Enable-LocalUser come with Windows PowerShell 5.1, which every Windows 11 edition includes.

Enabling the account doesn't give it a password. When I enabled it in September 2023, it had none, so anyone at the keyboard could sign in with full administrator rights. Set one before you sign out:

net user administrator *

The asterisk makes net user prompt for the password twice, without showing it on screen. Avoid typing the password directly on the command line, where it stays in the console history, and in PowerShell's history file on disk. On computers set up with Windows 11 22H2 or later, Windows requires this password to mix at least two of lowercase letters, uppercase letters and numbers (KB5020282).

Once the Administrator account is enabled, you can log in as the Administrator. Sign out, or press Ctrl+Alt+Del and choose Switch user. Your login screen should contain the new entry for the Administrator account:

The first sign-in takes a minute, since Windows creates a new profile for the account.

If you didn't set a password from the Command Prompt, set it now by pressing Ctrl+Alt+Del and selecting the Change a password option.

Keep in mind that this account behaves differently from your own administrator account. By default, the built-in Administrator runs every application with full administrator privileges, without the UAC prompts you're used to. That's why Microsoft recommends keeping it disabled and signing in with it only when you need it.

Windows 11 Pro, Enterprise and Education include two graphical tools that do the same as net user. Windows 11 Home doesn't include either of them, so use the Command Prompt or PowerShell there.

Local Users and Groups (lusrmgr.msc):

1. Press Windows+R, type lusrmgr.msc, and press Enter.
2. Open the Users folder and double-click Administrator.
3. Clear the Account is disabled checkbox and click OK.

Local Security Policy (secpol.msc):

1. Press Windows+R, type secpol.msc, and press Enter.
2. Go to Local Policies > Security Options.
3. Double-click Accounts: Administrator account status, select Enabled, and click OK.

Many people looking for the Administrator account just need administrator rights for their everyday account, or for another user's. In that case, don't enable the built-in account: change the account type instead.

From another administrator account (the built-in one works), go to Settings > Accounts > Other users, select the account, click Change account type, choose Administrator, and click OK. Settings doesn't list the account you're signed in with, so you can't change your own type from it.

From an elevated Command Prompt, net localgroup administrators marc /add does the same for the user marc (replace it with your user name as net user lists it). The group name is translated too (Administradores on a Spanish installation); the PowerShell equivalent uses the group's SID, which is the same in every language:

Add-LocalGroupMember -SID S-1-5-32-544 -Member marc

To create a new administrator account from the Command Prompt instead, create the user and add it to the group:

net user marc2 * /add
net localgroup administrators marc2 /add

When you're done, sign out of the Administrator account, sign in with your own account, and run this from an elevated Command Prompt:

net user administrator /active:no

Before you run it, make sure your own account is an administrator: run net localgroup administrators and check that your user name is in the list. If it isn't, add it first (see above); otherwise, you lose your only way to make administrative changes. In Windows PowerShell, Get-LocalUser | Where-Object SID -like '*-500' | Disable-LocalUser disables it whatever its name.

No, and that's by design: enabling an administrator account requires administrator rights. If UAC asks you for an administrator password you don't have, these are your options:

• Someone else is the administrator (a family member, your company's IT department): ask them. On a work computer, policy may block the built-in account anyway.
• You're the administrator but forgot your password: reset it. For a Microsoft account, select I forgot my password on the sign-in screen; for a local account, select Reset password after a wrong attempt and answer your security questions. Microsoft explains both in Change or reset your password in Windows.
• No administrator account is enabled at all: start Windows in safe mode. On a computer that isn't joined to a domain and has no other administrator account enabled, safe mode enables the built-in Administrator account, and Windows disables it again on the next normal start. Sign in with it, make your own account an administrator, and restart. If your device is encrypted, Windows asks for your BitLocker recovery key on the way.

• Windows XP: How to enable the built-in Administrator account
• Windows: How to kill a process from the command line
• Windows: List all environment variables (CMD, PowerShell)
• How to check open TCP/IP ports in Windows