Create a local user or administrator account in Windows 10

You can create a local user account (an offline account) for anyone who will frequently use your PC. The best option in most cases, though, is for everyone who uses your PC to have a Microsoft account.

If needed, the local user account can have administrator permissions; however, it’s better to just create a local user account whenever possible.

Caution: A user with an administrator account can access anything on the system, and any malware they encounter can use the administrator permissions to potentially infect or damage any files on the system. Only grant that level of access when absolutely necessary and to people you trust.

As you create an account, remember that choosing a password and keeping it safe are essential steps. Because we don’t know your password, if you forget it or lose it, we can’t recover it for you.

If you’re using Windows 10, version 1803 and later, you can add security questions as you’ll see in step 4 under Create a local user account. With answers to your security questions, you can reset your Windows 10 local account password. Not sure which version you have? You can check your version.

Create a local user account

Select Start > Settings > Accounts and then select Family & other users. (In some versions of Windows you’ll see Other users.)

Select Add someone else to this PC.

Select I don’t have this person’s sign-in information, and on the next page, select Add a user without a Microsoft account.

Enter a user name, password, or password hint—or choose security questions—and then select Next.

Change a local user account to an administrator account

Select Start > Settings > Accounts .

Under Family & other users, select the account owner name (you should see «Local Account» below the name), then select Change account type.

Note: If you choose an account that shows an email address or doesn’t say «Local account», then you’re giving administrator permissions to a Microsoft account, not a local account.

Under Account type, select Administrator, and then select OK.

Sign in with the new administrator account.

Local Accounts

Applies to

• Windows 10
• Windows Server 2019
• Windows Server 2016

This reference topic for IT professionals describes the default local user accounts for servers, including how to manage these built-in accounts on a member or standalone server.

About local user accounts

Local user accounts are stored locally on the server. These accounts can be assigned rights and permissions on a particular server, but on that server only. Local user accounts are security principals that are used to secure and manage access to the resources on a standalone or member server for services or users.

This topic describes the following:

For information about security principals, see Security Principals.

Default local user accounts

The default local user accounts are built-in accounts that are created automatically when you install Windows.

After Windows is installed, the default local user accounts cannot be removed or deleted. In addition, default local user accounts do not provide access to network resources.

Default local user accounts are used to manage access to the local server’s resources based on the rights and permissions that are assigned to the account. The default local user accounts, and the local user accounts that you create, are located in the Users folder. The Users folder is located in the Local Users and Groups folder in the local Computer Management Microsoft Management Console (MMC). Computer Management is a collection of administrative tools that you can use to manage a single local or remote computer. For more information, see How to manage local accounts later in this topic.

Default local user accounts are described in the following sections.

Administrator account

The default local Administrator account is a user account for the system administrator. Every computer has an Administrator account (SID S-1-5-domain-500, display name Administrator). The Administrator account is the first account that is created during the Windows installation.

The Administrator account has full control of the files, directories, services, and other resources on the local computer. The Administrator account can create other local users, assign user rights, and assign permissions. The Administrator account can take control of local resources at any time simply by changing the user rights and permissions.

The default Administrator account cannot be deleted or locked out, but it can be renamed or disabled.

In Windows 10 and Windows Server 2016, Windows setup disables the built-in Administrator account and creates another local account that is a member of the Administrators group. Members of the Administrators groups can run apps with elevated permissions without using the Run as Administrator option. Fast User Switching is more secure than using Runas or different-user elevation.

Account group membership

By default, the Administrator account is installed as a member of the Administrators group on the server. It is a best practice to limit the number of users in the Administrators group because members of the Administrators group on a local server have Full Control permissions on that computer.

The Administrator account cannot be deleted or removed from the Administrators group, but it can be renamed.

Security considerations

Because the Administrator account is known to exist on many versions of the Windows operating system, it is a best practice to disable the Administrator account when possible to make it more difficult for malicious users to gain access to the server or client computer.

You can rename the Administrator account. However, a renamed Administrator account continues to use the same automatically assigned security identifier (SID), which can be discovered by malicious users. For more information about how to rename or disable a user account, see Disable or activate a local user account and Rename a local user account.

As a security best practice, use your local (non-Administrator) account to sign in and then use Run as administrator to accomplish tasks that require a higher level of rights than a standard user account. Do not use the Administrator account to sign in to your computer unless it is entirely necessary. For more information, see Run a program with administrative credentials.

In comparison, on the Windows client operating system, a user with a local user account that has Administrator rights is considered the system administrator of the client computer. The first local user account that is created during installation is placed in the local Administrators group. However, when multiple users run as local administrators, the IT staff has no control over these users or their client computers.

In this case, Group Policy can be used to enable secure settings that can control the use of the local Administrators group automatically on every server or client computer. For more information about Group Policy, see Group Policy Overview.

NoteВ В Blank passwords are not allowed in the versions designated in the Applies To list at the beginning of this topic.

ImportantВ В Even when the Administrator account has been disabled, it can still be used to gain access to a computer by using safe mode. In the Recovery Console or in safe mode, the Administrator account is automatically enabled. When normal operations are resumed, it is disabled.

Guest account

The Guest account is disabled by default on installation. The Guest account lets occasional or one-time users, who do not have an account on the computer, temporarily sign in to the local server or client computer with limited user rights. By default, the Guest account has a blank password. Because the Guest account can provide anonymous access, it is a security risk. For this reason, it is a best practice to leave the Guest account disabled, unless its use is entirely necessary.

Account group membership

By default, the Guest account is the only member of the default Guests group (SID S-1-5-32-546), which lets a user sign in to a server. On occasion, an administrator who is a member of the Administrators group can set up a user with a Guest account on one or more computers.

Security considerations

When enabling the Guest account, only grant limited rights and permissions. For security reasons, the Guest account should not be used over the network and made accessible to other computers.

In addition, the guest user in the Guest account should not be able to view the event logs. After the Guest account is enabled, it is a best practice to monitor the Guest account frequently to ensure that other users cannot use services and other resources, such as resources that were unintentionally left available by a previous user.

HelpAssistant account (installed with a Remote Assistance session)

The HelpAssistant account is a default local account that is enabled when a Remote Assistance session is run. This account is automatically disabled when no Remote Assistance requests are pending.

HelpAssistant is the primary account that is used to establish a Remote Assistance session. The Remote Assistance session is used to connect to another computer running the Windows operating system, and it is initiated by invitation. For solicited remote assistance, a user sends an invitation from their computer, through e-mail or as a file, to a person who can provide assistance. After the user’s invitation for a Remote Assistance session is accepted, the default HelpAssistant account is automatically created to give the person who provides assistance limited access to the computer. The HelpAssistant account is managed by the Remote Desktop Help Session Manager service.

Security considerations

The SIDs that pertain to the default HelpAssistant account include:

SID: S-1-5- -13, display name Terminal Server User. This group includes all users who sign in to a server with Remote Desktop Services enabled. Note that, in Windows Server 2008, Remote Desktop Services are called Terminal Services.

SID: S-1-5- -14, display name Remote Interactive Logon. This group includes all users who connect to the computer by using a remote desktop connection. This group is a subset of the Interactive group. Access tokens that contain the Remote Interactive Logon SID also contain the Interactive SID.

For the Windows Server operating system, Remote Assistance is an optional component that is not installed by default. You must install Remote Assistance before it can be used.

For details about the HelpAssistant account attributes, see the following table.

HelpAssistant account attributes

S-1-5- -13 (Terminal Server User), S-1-5- -14 (Remote Interactive Logon)

Complete Guide to Manage User Accounts in Windows 10

Want to create a new user account on your Windows 10 PC? Manage everything about an account? Set up a PIN instead of a long password? Welcome to our Windows 10 User Account Guide 101! In this post, I am exploring all possible options around a user account, and how it can be managed. It will be helpful for those who are new or even if you are an expert, you can find things which will help you set-up another account on your PC, and manage it in every aspect.

Manage User Accounts in Windows 10

Windows 10 Settings offer a central place under Accounts settings to manage all user accounts where you can configure everything except a few settings, that we will tell you as we go ahead.

Using Microsoft account or Local account?

When installing Windows 10, the Setup process asks for a Microsoft Account or lets you create a local admin account. If you don’t remember what you did during the setup, then its time to find out everything about your account – especially if you are still using a local account.

Go to Settings > Accounts. Here you can view details of your account including Microsoft Account association, Administrator or local account, profile picture, and so on. You will have 6 sections here:

• Your info
• Email & App Accounts
• Sign-in Options
• Access work or school
• Family & Other people
• Sync your settings.

If your account is a Microsoft account (check if there is an Outlook or a Hotmail or a Live ID), then a lot of things are already sorted, but if its a Local Account, you should link it to a Microsoft Account. You can create it on the fly if you don’t have one at all. There are many reasons you should, and we will get to learn about it as we move ahead.

Link Local Windows 10 Account with Microsoft Account

So if it reads “Local Account” under your username, look for a link which says Sign in with a Microsoft Account instead. Post that you can enter your email ID, and password to link this PC and account with your MSA. It is possible that Microsoft will verify your account, new or old, with your phone number to enable features like Sync and File Settings across devices.

Linking your local Windows 10 Account with Microsoft Account (MSA) has many benefits. One of the major benefits is that it will link your Windows 10 License Key with your Account. So the next time when you install Windows 10, and sign-in with your same MSA account, it will not ask you to activate Windows. Apart from this, you need an MSA account for downloading apps from the Store as well.

Some of your Apps use different email account?

It is possible that you might have used a different email account for some of the apps or even for the Microsoft Store. While it is simple to use the same account for everything – but if it’s your choice to have another account for Store and other apps, you can add it without creating a second account.

Under Settings > Email & app accounts, you can add that account to Accounts used by other apps. This will make sure it is not connected with Outlook, Calendar, and Contacts. You will have to verify your account the usual way, including phone number verification. Once done, if your app asks which account to choose, you can select this one.

Multiple Ways to Sign-in to your Windows 10 PCs

While the most secure way to login to your Windows 10 PC is to use the complex password associated with your Microsoft account, it’s a tedious as well, especially when you lock, and unlock your PC multiple times.

Windows 10 Sign-in options page offers you option to use Windows Hello, PIN or Picture password and even Dynamic Lock options. The last option is my favorite. I have it configured with my Fitbit Ionic, and every time I move away from my PC, it locks it automatically. You can also connect to your Bluetooth headphone or even your speaker.

• A PIN is a 4 digit password which is just for the device where you set. You can have a different PIN for every Windows 10 device.
• Picture Password lets you select a picture, and draw three types of gesture on the image. These gestures become your password, but be careful that you remember where you are drawing the gestures.
• Windows Hello needs special Webcams.

This section also offers you to change your password, but remember it changes your Microsoft Account password. This means if you use it anywhere with Microsoft Services, you will have to use the new password if you change.

Read: How to obtain List, Settings & Details of all User Accounts using the command line.

Require Sign-in & Privacy

Now that your password is all set, its time to tighten up security a bit. Windows 10 Sign-in options offer you to option where you will need to enter password or pin again, in case your PC sleeps. This will make sure your PC isn’t directly accessible when it wakes up.

Go to Settings > Sign-in options > Select When PC wakes up from sleep.

Under Privacy, you can choose to hide your email address on sign-in screen and let Windows 10 remember your password for an uninterrupted update. The later is a very useful feature if you have to set to upgrade your PC overnight. This way you will save a lot of time when its time works in the morning.

Use Work or School Account on Personal PC

Many a time you would want to connect to your work or school with a dedicated account which has been assigned to you. Windows 10 has a dedicated setting for “Work Access” which lets you connect to the resources of the organization right from the home. You will need to talk to your network administrator to use the School PCs app.

Managing Family & Guest Account

We have an extensively detailed post on how you can manage your Family Accounts on a PC, there are few things you should know when you are setting up a second Windows 10 PC.

• For each Windows 10 PC, you will have to enable access by visiting Settings > Family & others.
• This will make sure all your settings and shared resources under Microsoft Family is honored.
• Child account is just like a Standard user account with more restriction when it comes to downloading games and apps.
• It’s highly recommended to not make your spouse an Administrator unless you are very confident she or he will be able to handle things.

The ability to add guest account was removed in Windows 10. Windows 10, v1607 introduced Shared or Guest PC Mode. This sets up Windows 10 Pro, Pro Education, Education, and Enterprise for limited use in certain scenarios.

Adding a Non-Family Member

If you need to let somebody access your PC, it is always a good idea to use Windows 10 Guest Account, but in case the person needs access for a longer period of time, its best to add his email id to your PC. This way he gets a standard account with restrictions.g:

1. Open Settings > Accounts > Family & other People > Add someone else to this PC.
2. Ask the person to sign-in with his MSA account, and he will be all set.
3. You can also create a new MSA account if it becomes necessary from the same screen.

Removing and Disabling an Account

Under Family & Other people section, you can select an account you want to remove, and hit the Remove Button. If you wish to remove a family member, you will get an option to Block the person from Sign-in. This post shows how you can enable or disable a User Account.

Sync your Settings

If you wish to have the same kind of themes, language preferences, and other things on all Windows 10 devices, turn on Sync Settings.

If you read till here, and all the posts we linked in here, you now know everything about Windows 10 User Account management. If you still have a question, do let us know in the comments.

Attribute	Value