This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 80%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Hi! We have our AD builtin admin account as administrator and we want to change it to something different. What is the safest way to do this without breaking anything? We are running AD 2012. Thanks
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(281.6, 80%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETB%3C/text%3E%3C/svg%3E)
Hi
Of course You can rename builtin administrator without any issue. I have already renamed it in our production environment without any issue. You can rename it manually or use a GPO to rename builtin administrator in default domain controller policy.
Please don’t forget to accept helpful answer
Hi! Thanks. Did you rename in manually or via GPO? Can you please advice on the steps do you did? Thanks
One of my customers is using GPO, to be able to rename automatically if the name is changed by mistake by a administrator.
Others customers prefer to rename it manually.
Please don’t forget to accept helpful answer
Thanks. It will keep the same old password?
yes the password will still the same. Only account name will be changed.
Please don’t forget to accept helpful answer
Just checking if there is any progress ?
Please don’t forget to accept helpful answer and close this thread
@Thameur-BOURBITA I can see on my domain controllers that Rename administrator account is already set to my current domain admin account. If I see under local security policy. I don't find that it is push via any group policy I don't find any settings for it in the group policy. Not sure how it was done.
The most important thing is that the builtin account is renamed whatever the method. So you rename it manually using dsa.msc console.
Please don’t forget to accept helpful answer and close this thread
@Thameur-BOURBITA I understanding your point but I am trying to understand the logic here. The is no group policy in the AD that says that rename admin user but on the domain controllers there is local security policy that says that rename admin account is xyz. May be the old guy can tell but if there is not group policy in AD then was it done manually on each DC by going under the local security policy and then setting the value to xyz which doesnt look like the right way. secondly if I rename the user xyz to tyt from Active directory user and computer the the local policy on the domain controller still have xyz then as what I remember that the local policy always wins then its xyz.
Please note, there are two types of builtin administrator account.
At the domain level, there is a builtin domain administrator account, and this account you can rename it manually via the dsa.msc coonsole and no need to use either GPO or make the modification on all domain controllers. The renaming will be replicated through AD replication on all domain controllers. If you see any local GPO configured to rename builtin administrator you can neglect it.
At the member machine level, there is a local builtin administrator account which can be renamed through a GPO.
Please don't forget to accept helpful answer and close this thread
Thameur-BOURBITA Thanks for the explanation. The thing that is creating the confusion is that this builtin domain administrator account and the account that is mentioned in rename builtin administrator has the same name. Like xyz user is the Built in account for administering the computer/domain and xyz is also in the rename builtin administrator setting as well.
@Sajid Mumtaz Yes. To avoid any confusion you should take note that all domain accounts can be renamed only through active directory not GPO. but local accounts in member machines can be renamed through GPO. Please don't forget to accept helpful answer
@Thameur-BOURBITA I have rename the username via ADUC.
I can login via the new username but its still using the same old admin user folder under users. May be its its the same sid but not sure.
Secondly it kind of broke few things. I have a file server and we used to login to it via old administrator account and were able to do everything but now if I login to it via new admin user but when I try to select change ethernet settings then it says I dont have permission. If I try to open edit group policy on the file server then I got permission error as well. Here is the error.
I can use the shortcut like ncpl go go direct to ethernet interface settings but via the GUI it doesnt work and give permission error.
Hi, Yes you can rename it also along with the guest account, and in fact its recommended from a security standpoint. Here is an older guide but should work fine. https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/rename-administrator-and-guest-account Good luck! Marius Ene - https://mariusene.com/
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(54.400000000000006, 93%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMF%3C/text%3E%3C/svg%3E)
I have same issue to rename domain administrator account but this account has mailbox. if i can rename it using GPO or via active directory user and computers.
any impact ...plz let me know
