How to Create a Local Administrator Account without Exposing the Password
Applies to: Windows Server 2019, 2022 and 2025.
A named administrator improves accountability. Enter passwords as SecureString values; never store them in command history, articles or tickets.
Work from console access or a tested recovery path. Changes to remote access, licensing or domain membership can lock out administrators if prerequisites are wrong. Managed Windows VPS options are available at networkmanager.info.
Prerequisites
- Confirm policy permits the local administrator.
- Define ownership and an expiry or rotation process.
- Use an existing approved administrator session.
- Plan Windows LAPS where suitable.
Step-by-step procedure
Step 1: Prompt securely
Capture a password without plain text.
$password = Read-Host 'Enter a unique password' -AsSecureStringStep 2: Create the account
Add a description that explains purpose.
New-LocalUser -Name 'OpsAdmin' -Password $password -FullName 'Operations Administrator' -Description 'Approved server administration account'Step 3: Grant membership
Add the account to built-in Administrators.
Add-LocalGroupMember -Group 'Administrators' -Member 'OpsAdmin'Step 4: Test separately
Open a controlled separate session before ending the original administrator session.
Step 5: Document lifecycle
Record owner, rotation, monitoring and removal conditions without recording the password.
Verification
Confirm the account exists and membership is limited to approved groups.
Get-LocalUser -Name 'OpsAdmin'
Get-LocalGroupMember -Group 'Administrators'Rollback
Remove group membership, disable the account and delete it only after confirming no service or recovery process depends on it.
Version and operational notes
Domain-managed environments should prefer named domain admin identities and LAPS-managed local credentials.
Official references
For managed deployment and support, visit https://networkmanager.info/.
