How to enable the local administrator account in Windows without logging in

Having a Standard user account in Windows is great for security, as it prevents malicious software from installing. But what happens if you need to install software and do not have administrative privileges? Here is how to enable the local administrator account in Windows without logging in.

I recently had a customer with a somewhat unique problem: she needed to install software on her computer, but her user profile was set to Standard. She shared the computer with her husband; his account was an Administrator account, and he used a Microsoft account to log in.

But unfortunately, her husband passed away, and she proceeded to take care of her husband's affairs. In the process, she disconnected his cell phone and deleted his e-mail address. It was not until she needed to install software on her computer that she realized she did not have administrator privileges.

The easiest option would be to perform a clean Windows installation. But since she could not reinstall the tax software, wiping the drive and reinstalling Windows was the last option.

And since all methods of recovering her husband's Microsoft account were no longer available, the only option was to enable the hidden local administrator account and change her account from Standard to Administrator. Since her account was only a Standard user, using a NET command line was impossible, so this would take a little more work.

Note: The following procedures require Windows installation media, editing the registry, and the BitLocker decryption key (if your drive is encrypted). Editing the Registry incorrectly can cause errors and possibly prevent your computer from booting. If you do not feel comfortable editing the registry, please contact a local computer technician for assistance.

The first step is to create the installation media, which requires an 8GB or larger USB drive. You will need administrative privileges to create the media, so you may need to create it on another Windows system with a user account with administrator privileges.

Create Windows 11 installation media

Create Windows 10 installation media

The second step is to check whether the drive on your computer is BitLocker-encrypted, if you can. Luckily for my customer, her computer did not have BitLocker drive encryption enabled. If your drive is encrypted, you will be prompted for the decryption key when you boot your computer up on the installation media. The easiest way to find out whether any of your drives are encrypted is to remove them, attach them to another Windows computer, and check their properties in File Explorer.

1. Open File Explorer using one of the following:
1. Left-click on the File Explorer icon (manila folder) on the Taskbar.
2. Press the Windows logo key + E at the same time.
3. Use the Power User menu by right-clicking on the Start button and selecting File Explorer.
2. In the left-side column, left-click on This PC.
3. In the right-side column, check the icons for the drives. Encrypted drives should have a small padlock icon.

If your drive is BitLocker encrypted, use the following link to log in to your Microsoft account and find your recovery key. If another person set up your computer, they might have the recovery key inside their Microsoft account. Once you get the BitLocker recovery key, print it out or write it down for future use.

Locate my BitLocker recovery key

Next, you will need to boot up your computer using the installation media. The easiest way to do this is to use the Advanced Boot Options. Make sure you have the Windows installation media connected to your computer before proceeding, so it appears as a bootable device in the Advanced Boot Options.

How to get to Windows 11 Advanced Boot Options

How to get to Windows 10 Advanced Boot Options

Once you reach the Advanced Boot Options, select Use a device, then choose the media you created earlier. Your computer will restart and boot from the installation media.

1. When the Windows Setup dialog box appears, left-click on Next.
2. In the following dialog box, left-click on Repair this computer. At this point, you may be prompted for a decryption key. Enter it in the provided space and continue.
3. On the Choose an option page, left-click on Troubleshoot.
4. On the Advanced options page, left-click on Command Prompt.
5. In the Command Prompt, type regedit and press Enter.
   
6. In the Registry Editor, highlight HKEY_LOCAL_MACHINE in the left-hand column.
   
7. With HKEY_LOCAL_MACHINE highlighted, pull down the File menu and left-click on Load Hive ....
   
8. Locate the local drive that has Windows installed on it, then navigate to Windows > System32 > config folder.
   
9. Left-click the file named SAM (Security Account Manager), then select Open.
   
10. When prompted for a Key Name, give it a unique name (we used TempSAM) and select OK.
    
11. Expand the registry hive you just attached, and navigate to:
    Computer\HKEY_LOCAL_MACHINE\WhateverYouNamedYourHive\SAM\Domains\Account\Users\000001F4
    
12. Double-click on the F binary value to edit it.
    
13. In the Edit Binary Value dialog box that appears, change the value at 00000038 from 11 to 10, then select OK.
    
14. Close the Registry Editor, then restart your computer.

The local administrator account should now appear as a logon option and have no password by default.