Administrator Account Security in Active Directory

Q: What are some common best practices for securing the default Administrator account in a Windows Active Directory (AD) domain?

A: A common security best practice for protecting the Administrator account is to disable it, rename it, and then change the text in its Description field. Not only will this hide the account but it will also hide the most visible indications that this is the almighty Administrator account. (You can always recognize the Administrator account from its security identifier—SID, which ends in 500.)

Another option is to create a decoy user account called Administrator that has a very limited set of permissions or no special permissions or user rights.

If you don't want to disable the Administrator account (it can be a life-saver if you lock out your day-to-day admin account), it's a good idea to always give the account a long, complex, and random password that you change at regular intervals.

Finally, make sure that you have an automated procedure in place to accomplish these tasks. For automation, you can use a combination of Group Policy Object (GPO) settings and PowerShell scripts.