Windows 10 Local Admin Account Password Expired?

Topic

New Reply

I am using a software stack on a Windows 2-in-1 (HP ENVY series) PC that was new at Christmas:

1. Windows 10 Home with With Windows 10 Home installed.  Set up PC with Microsoft Account using Windows Hello with built-in webcam.  Hello works well for me.
2. Upgraded to Windows 10 Pro within a day.  Added a local admin account so that           Microsoft Account defaulted to standard account.
3. Began to use existing license for Office 365 Business Premium (now Microsoft 365 Business Standard) immediately
4. Several months later, upgraded to Microsoft 365 Business Premium to have built-in Azure MFA and Intune for security and systems management.  Set up Global Admin account.
5. At some time — I am not sure whether it was before or after taking step 4 — I found that my local admin account password had expired.  I had not expected this to happen.  This leads me to several questions:
   1. What are the advantages and disadvantages of keeping a local admin account when I now have two global admin accounts (redundancy for safety, possible operator error) on the same device?
   2. If I want to keep the local admin account, how do I maintain an updated password for it?
   3. If I do not want to keep the local admin account, how do I delete it?

 

Thank you in advance for your thoughts on this subject.

Reply | Quote

Replies

You should set the password on your local admin account to never expire.

There is no point removing the account. If you never use it, fine, if you need it…

cheers, Paul

Reply | Quote

Paul,

Thank you for your reply.  Is there any way to get back to the point where I can reset the account to never expire?

Since this system was upgraded from Home to Pro, when I first log in, I believe that I default to being outside of the protection of Microsoft 365 Business Premium, and, in fact, in my Microsoft Account.

Even if I bought a system with a Pro license pre-installed, wouldn’t I default to logging in with a Microsoft Account?

Very truly yours,

Jonathan Handler

Reply | Quote

On a new system, or a clean install, if you disconnect from the Internet during the install, you can create a Local Account. Microsoft has hidden the procedure by making the links to continue (without an MS account) obscure. Like “continue with limited experience,” or something to that effect.

You have to do the setup disconnected, and not let the PC look for updates, during the installation if you want the Local Account.

Reply | Quote

Windows defaults to creating an MS account when you set it up.
This shouldn’t prevent you from modifying local accounts via Start > Settings > Accounts > Other Accounts.

cheers, Paul

Reply | Quote

Paul, PK,

Thank you both for your assistance.  Paul, you were going in the right direction.  PK, you were absolutely correct that I miss disconnect from the Internet to get this to behave the way that Paul describes.  I finally found this article, which was last updated October 2, 2019:

https://www.pcmag.com/how-to/how-to-set-up-windows-10-with-a-local-account

This makes me switch my attention away from my PC right now because it means that my local admin account is now expired and cannot be used to escalate privilege when the computer receives malware that would need to escalate privilege to do damage.

I have a second identical computer (computer 2) that I have not plugged in since I bought the two computers together from Costco during Christmas 2019 shopping.  I want to upgrade computer 2 through Steps 1, 2, (skip Step 3 because it was a necessary backwards compatibility requirement for computer 1) and Step 4.  I will make sure that Windows Hello is disabled through Steps 1 through 4 (because this computer will be shipped to a close relative who is 400 miles away) and joining me in my business and depend upon a password and a PIN for the time being.  The relative will be training the computer on her face after she turns it on and before or after she plugs it into the Internet.  I  believe that I will need to keep computer 2 off the Internet through Steps 1 and 2, which will require me to license the Windows 10 Home to Windows 10 Pro Upgrade  as a USB drive installation.  Is that correct?  Then I can log in Computer 2 to the Internet using the Local Administrator to install Microsoft 365 Business Premium with its desktop apps via Windows Autopilot running from computer 1 within my home office (pretending that this is a remote install for a customer who is upgrading from Windows 10 Pro on one of his/her business computers).

Does all of this make sense?

Very truly yours,
Jonathan Handler

Reply | Quote

I have a suggestion for setup:

Set up the computer OFFLINE, creating a Local Account (Administrator). That account password should not expire. Be sure there is nothing in the setup you do that requires/requests that when you create the account. (Write the password and hint down)
Do not do updates the install requests several times (you are not connected to the Internet).
Get all the settings correct in the Settings App and Control Panel, particularly for Windows Update.
Then, go online, activate Windows, and do any required updates to bring it up to date.

Now, create the Microsoft Account and set it up like you want. In the Settings App, under Account Settings, do not let the MS account alter your Local account. Turn off “Use my sign-in to automatically finish setting up my device.”

You should be able to log in to one or the other account independently.

Reply | Quote

PK,

I like your new idea of

1,  First setting up the computer offline using Windows 10 Home to create a Local Administrator Account.  Then diverge from your idea.

2.  Then staying with Windows 10 Home to create a Local Standard Account from the Local Administrator Account.

3.  Upgrade to Microsoft 365 Business Premium with these two accounts established and download and configure its desktop applications.  Use the computer under this scenario until my relative comes up with a reason to need to have a Microsoft Account (I have no idea what it would be as I write this)?

4.  Add the Microsoft Account when needed.

This way there would be less chance for a hacker to get into the Microsoft Account.

Very truly yours,

Jonathan Handler

Reply | Quote

[PKCano]

Keep the Admin account (unused) and the Standard account. You may need the Admin account for certain functions/access.
You will need a MS account to use Microsoft 365 Business Premium I believe, but you may not have to to use it to log in to the computer itself, only to the 365 app.

I’m not familiar with MS’s rent-an-app business. I want my applications local and controlled by ME. Still using Office 2010, the msi version.

• This reply was modified 4 years, 11 months ago by PKCano.

Reply | Quote

Not sure if this is what you were looking for “Password never expires” for Local Account.
Post 2268934 mentions it. It seems to get complicated once you have the Microsoft Account involved.

Right-click Start -> Computer Management -> System Tools -> Local Users and Groups -> Users
Left-click on the user, right-click Properties, check “Password never expires”

Reply | Quote

I’m not sure that lusrmgr.msc is available in the Home Edition. I may be wrong, but I think you have to have Pro.

Reply | Quote

PK is correct – that function is not available on Windows 10 Home version (I’m using v1909).

1 user thanked author for this post.

Elly

Reply | Quote

PK, Paul, KP and Cijan:

Thank you all for contributing to this discussion around my original question.

I have no interest in this discussion continuing at this time, but I cannot tell whether or not I will have to look at it again in the future.

I have come up with a very different question, for which I will next start another thread, tomorrow, after the Fourth of July ends.

 

Reply | Quote

You mentioned a dis-interested in this discussion for now, so I will only provide a summary of my idea. There are parts of this idea that are not fully developed, hence forewarned.

Use Fred Langa’s article to create a new local admin account using WinRE.
The next part is a work in progress, if you decide to try a solution following this line of thinking. The new local admin can change the old local admin’s password, so it won’t be considered expired.

P.S. Sorry my previous post was from a Windows 10 Pro PC and I did not know Windows 10 Home was different.

I did try WinRE on Windows 10 Home this time.

Reply | Quote

I have remote users.  We set them up to have a remote local windows 10 machine.  they were set up as “users” and did not have admin rights on the machine.  this was done for security/malware reasons.  their passwords have expired and they cannot logon their local machines to then log into the office.  Without giving them “admin” login information, or visiting their homes, is there anyway they can reset their passwords?  they go through the process but it tells them they don’t have permissions.  Again these are stand alone machines that do nothing but connect to our office.  they do not run local apps off their machine.

Reply | Quote

TamiK wrote:

Without giving them “admin” login information, or visiting their homes, is there anyway they can reset their passwords?

No.

(Someone set passwords to expire, as local accounts don’t do that by default.)

Reply | Quote

thanks- at least now i know my options.

1 user thanked author for this post.

b

Reply | Quote