Rename the built-in Administrator account

Password-guessing bots almost always try the username Administrator first. If that account does not exist under that name, every one of those attempts fails before the password even matters. Renaming the built-in account is quick, cuts down the noise in your security log, and costs nothing. This guide shows two ways to do it and the things to update so you do not lock yourself out.

Before you start

• Administrator access over Remote Desktop to 203.0.113.10:3389.
• Access to the browser console in your VPS provider's control panel, as a fallback.
• A new name that is not obvious. Avoid admin, administrator1, root or your company name. Something like ops-k7 works well.

What renaming does and does not do

• The account keeps its password, profile, group memberships and files.
• Its security identifier (SID), which ends in -500, does not change. Skilled attackers can still find the account by SID, so renaming is a noise filter, not a replacement for a strong password.
• Anything that signs in by name must use the new name from now on.

Update saved logins first

Before renaming, list everything that uses the name Administrator:

• Saved credentials in Remote Desktop Connection, Windows App or connection managers on your computers.
• Credential Manager entries on your PC (search for "Credential Manager" in Start).
• Scripts, backup jobs or monitoring tools that connect with the username.
• Services and scheduled tasks on the server that run as Administrator.

Check services and tasks on the server:

Get-CimInstance Win32_Service |
  Where-Object StartName -like "*Administrator*" |
  Select-Object Name, StartName

Get-ScheduledTask |
  Where-Object { $_.Principal.UserId -like "*Administrator*" } |
  Select-Object TaskName, TaskPath

Make a note of anything listed. You will check those items after the rename.

Rename with PowerShell

Open PowerShell as Administrator:

Rename-LocalUser -Name "Administrator" -NewName "ops-k7"

Confirm the change. The SID ending in -500 identifies the built-in account:

Get-LocalUser | Where-Object SID -like "*-500" | Select-Object Name, Enabled, SID

You stay signed in. The current session keeps working.

Rename with Local Security Policy

1. Press Win + R, type secpol.msc and press Enter.
2. Go to Local Policies → Security Options.
3. Double-click Accounts: Rename administrator account.
4. Enter the new name and click OK.

You can also use Local Users and Groups (lusrmgr.msc): right-click Administrator under Users and choose Rename.

Test before signing out

1. Keep the current Remote Desktop window open.
2. On your computer, open a new connection to 203.0.113.10:3389.
3. When asked for credentials, choose More choices → Use a different account and enter the new username with the same password. You can also write it as .\ops-k7, where .\ means "a local account on this server".
4. Confirm you reach the desktop.

Then update the saved credentials in your RDP apps, and check the services and tasks you noted earlier. Services and tasks that stored the old name may need their account re-entered and the password typed again.

Optional: create a decoy

Some admins create a new, disabled standard user called Administrator with a long random password. Bots then hit a disabled account that cannot be used. This is optional. It adds a little noise reduction in logs, but your lockout policy and strong password matter far more.

Troubleshooting

• "The user name or password is incorrect" with the new name: check the spelling and try .\newname so Windows looks for a local account.
• A service fails to start after the rename: open services.msc, open the service's Log On tab, and enter the new account name and password.
• A scheduled task fails: open it in Task Scheduler, click Change User or Group, and pick the renamed account again.
• Locked out completely: open the browser console from your VPS provider's control panel. Sign in there with the new name. If you forgot it, see Fix a forgotten Windows password on your VPS.

Next steps

• Keep a second way in: Create a backup administrator account.
• Slow down password guessing: Set an account lockout policy against RDP password guessing.
• More hardening ideas: Secure Remote Desktop on Windows Server.