You want to prevent anyone from logging on with the default built-in “Administrator” account on a Windows NT Server, without breaking system functions that expect an administrative identity. What is the recommended mitigation?

Introduction / Context:
The well-known “Administrator” account is a common target for brute-force attacks. On legacy Windows NT systems, best practice was to reduce exposure without breaking built-in expectations for an administrative identity. One classic mitigation is to rename the account, optionally creating a disabled decoy named “Administrator.”

Given Data / Assumptions:

• You must keep administrative capabilities intact for system operations.
• Windows NT permits renaming the built-in Administrator account.
• Account lockout policies typically do not apply to the built-in Administrator in NT.

Concept / Approach:
Renaming obscures the default username targeted by automated attacks. Deleting the account is unsupported and dangerous. Disabling the built-in Administrator can break recovery paths and services that rely on it. Lockout policy does not protect this account reliably in NT. Therefore, the pragmatic and supported step is to rename it and manage strong passwords; optionally create a disabled honeypot account named “Administrator” to detect attempts.

Step-by-Step Solution:

Verification / Alternative check:
Security baselines for legacy Windows environments consistently recommended renaming the Administrator account, alongside enforcing complex passwords and auditing logon attempts, confirming this as a sound mitigation for NT-era systems.

Why Other Options Are Wrong:

• Delete: unsupported and risks system instability.
• Lock out: built-in Administrator typically bypasses lockout in NT.
• Disable: removes a critical recovery path and may break services.
• Remove from Administrators: cannot; the account defines the role.

Common Pitfalls:
Relying solely on renaming without strong passwords; forgetting to audit and restrict network logon rights; exposing the account via SMB/Remote Registry unnecessarily.

Final Answer:
Rename the Administrator account to a non-obvious name and use a decoy