# Configure 'Accounts: Rename administrator account'

The necessity of renaming the built-in administrator account is to mitigate brute-force and dictionary attacks. The username 'Administrator' is a universally known, default credential, making it a primary target for attackers who then only need to guess the password. Renaming this account forces an attacker to guess both a non-standard username and a complex password, significantly increasing the difficulty of unauthorized access. The audit script verifies the current name of the account associated with the administrator's well-known SID. The remediation script performs the action of renaming this account to a new, user-specified value. The recommended state for all levels (Basic, Moderate, and Strict) is to ensure the name is not the default 'Administrator'. While the state itself is binary (default or not), for Moderate and Strict levels, the chosen name should adhere to a strong, non-obvious naming convention, avoiding common alternatives like 'Admin' or 'SysAdmin' to further enhance security through obscurity.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Not "Administrator"']` |
| **Moderate** | `['Not "Administrator"']` |
| **Strict** | `['Not "Administrator"']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to find the local user account with the Security Identifier (SID) ending in '-500', which is the well-known SID for the built-in administrator account. The script must output only the 'Name' property of this account as a string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single, positional command-line argument representing the new desired name for the administrator account. The script must find the local user with the SID ending in '-500' and rename it to the value provided in the argument. The script must return the boolean value $true on success and $false on failure.

