For new installations, after the end user creates a user account in OOBE, the built-in Administrator account is disabled.
For upgrade installations, the built-in Administrator account remains enabled when there is no other active local administrator on the computer, and when the computer is not joined to a domain.
Use either of the following methods to disable the built-in administrator account:
Run the sysprep /generalize command
When you run the sysprep /generalize command, the next time that the computer starts, the built-in Administrator account will be disabled.
Use the net user command
Run the following command to disable the Administrator account:
net user administrator /active:no
You can run this command after you configure the computer and before you deliver the computer to a customer.
Original equipment manufacturers (OEMs) and system builders are required to disable the built-in administrator account before delivering the computers to customers. To do this, you can use either of the following methods.