# Configure 'Accounts: Rename administrator account'

Necessity: The built-in administrator account is a well-known target for brute-force and dictionary attacks because its name, 'Administrator', is default on all Windows systems. Renaming this account forces an attacker to guess both the username and the password, significantly increasing the effort required to compromise the system and mitigating automated attacks. Auditing and Remediation: The audit script confirms the current name of the built-in administrator by looking up its static SID (ending in -500), ensuring it doesn't matter if it has been renamed before. The remediation script uses the same SID lookup method to locate the account and applies a new name provided by the user. Recommended State Rationale: The goal is to move away from the guessable default. 'Basic' ('CorpAdmin') is a simple, non-default name. 'Moderate' ('LocalSvcMGR') is less obvious and avoids common terms like 'Admin'. 'Strict' ('LclAdmAcct9$') represents a policy of using a complex, non-dictionary name that is difficult to guess, providing the highest level of security through obscurity for this specific attack vector.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['CorpAdmin']` |
| **Moderate** | `['LocalSvcMGR']` |
| **Strict** | `['LclAdmAcct9$']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that identifies the local user account with the Security Identifier (SID) ending in -500, which corresponds to the built-in administrator account. The script must return only the current 'Name' of this account as a string.

## Remediation Script Working

PowerShell script that accepts a single, positional string argument from the command line representing the new account name. The script must identify the local user account with the SID ending in -500, rename it to the value of the provided argument, and return $true on success or $false on failure.

