Create a backup administrator account on your server

If your only administrator account gets locked out, its password is forgotten, or its profile breaks, you lose control of the server. A second administrator account, kept for emergencies, is a cheap insurance policy. This guide creates one, stores its password safely, and tests it over Remote Desktop on port 3389.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• A password manager to store the new password. See Use a password manager on your RDP server for ideas.
• A name for the account that does not reveal its purpose. Avoid backupadmin or admin2. Something like m.reyes-ops is harder to guess.

Why a backup admin helps

Common situations where a second admin saves you:

• Account lockout: bots guessing passwords can trigger your lockout policy on the main account. A different username is not affected.
• Forgotten or mistyped password: after a password change, a typo can leave you without access.
• Broken user profile: if the main profile is corrupted, Windows may load a temporary profile or fail to sign in.
• Accidental group change: removing your own account from Administrators by mistake.

The browser console in your VPS provider's control panel is always there too, but it still needs a working account and password. A second admin account gives the console something to sign in with.

Create the account

Open PowerShell as Administrator. Generate a long password in your password manager first, then run:

$pw = Read-Host -AsSecureString "Password for the backup admin"
New-LocalUser -Name "m.reyes-ops" -Password $pw -FullName "Emergency admin" `
  -Description "Break-glass account. Do not use day to day." -PasswordNeverExpires
Add-LocalGroupMember -Group "Administrators" -Member "m.reyes-ops"

• Read-Host -AsSecureString keeps the password off the screen and out of your PowerShell history.
• -PasswordNeverExpires stops the emergency account expiring when you need it. Use a long, unique password to make up for that.
• Membership in Administrators also allows Remote Desktop sign-in.

If you prefer the graphical tool, open lusrmgr.msc, create the user under Users, then add it to the Administrators group from the Member Of tab.

Store the password safely

• Save the username and password in your password manager, labelled with the server IP and the port 3389.
• If several people manage the server, store it in a shared vault that at least two of you can open.
• Do not save it in a text file on the server itself. If you are locked out of the server, you are also locked out of that file.

Test it over port 3389

1. Keep your current session open.
2. On your computer, open Remote Desktop Connection and enter 203.0.113.10:3389.
3. Choose More choices → Use a different account, enter .\m.reyes-ops and the password.
4. Confirm you reach the desktop. The first sign-in takes longer while Windows builds the profile.
5. Open PowerShell and run whoami /groups | findstr Administrators to confirm admin rights.
6. Sign out of the backup session with Start → Sign out, so it does not use one of your two admin session slots.

Also test it once in the browser console, so you know it works there.

Keep it healthy

• Do not use it day to day. Fewer sign-ins mean fewer chances for the password to leak.
• Test it every few months, and after major changes such as a new password policy.
• Watch for its sign-ins. An unexpected sign-in with this account is a red flag. You can find logon events in the Security log with event ID 4624. See Find RDP login history in Event Viewer.
• Rotate the password if anyone who knew it leaves.

Troubleshooting

• "The connection was denied because the user account is not authorized": the account is not in Administrators. Run Get-LocalGroupMember Administrators to check.
• New-LocalUser rejects the password: it does not meet the password policy. Use a longer passphrase with mixed character types.
• "The user name or password is incorrect": add .\ before the username so Windows uses the local account, and check for spaces when pasting.
• Signed in to a temporary profile: sign out and back in once. If it continues, see Fix RDP temporary profile.

Next steps

• Learn the account tools in depth: Manage local users and groups on Windows Server.
• Reduce brute-force noise on the main account: Rename the built-in Administrator account.