A single administrator account is a single point of failure. A second local admin with a long password and no daily use is the difference between a ten-minute fix and a reinstall.
Create a second local admin with **New-LocalUser** and **Add-LocalGroupMember**, confirm it can sign in once, and keep the password offline. Never use it for daily work.
**Get-LocalGroupMember** lists every member of the administrators group, including domain accounts. A machine with exactly one member has no second way in.
Get-LocalGroupMember -Group Administrators | Select-Object Name,ObjectClass,PrincipalSource
Get-LocalUser | Select-Object Name,Enabled,LastLogon
whoami /groups | Select-String -Pattern 'S-1-5-32-544'**New-LocalUser** takes a secure string and writes a local account without a Microsoft identity. A passphrase of five words is easier to type correctly and harder to guess than eight characters.
$pw = Read-Host -AsSecureString 'Passphrase for the backup admin'
New-LocalUser -Name 'AdminBackup' -Password $pw -FullName 'Backup Administrator' -Description 'Break-glass account' -PasswordNeverExpires
Get-LocalUser -Name 'AdminBackup' | Select-Object Name,Enabled,PasswordLastSet**Add-LocalGroupMember** grants the rights, and the account needs no other group. Keeping it out of Users and Remote Desktop groups reduces what it can do if the password leaks.
Add-LocalGroupMember -Group Administrators -Member 'AdminBackup'
Get-LocalGroupMember -Group Administrators
Get-LocalGroupMember -Group Users | Where-Object Name -like '*AdminBackup*'An account that was never used can still fail at the first sign-in. Switch user, sign in, open an elevated prompt and sign out again.
# Start > user icon > Switch user > sign in as AdminBackup
whoami
whoami /groups | Select-String -Pattern 'S-1-5-32-544'
# sign out againA password only stored in the browser profile of the account it protects is worthless. The password manager of your main account or a paper copy in a safe is the point of the exercise.
# password manager entry: machine name, account AdminBackup, passphrase
Get-LocalUser -Name 'AdminBackup' | Select-Object Name,Enabled,PasswordNeverExpires,LastLogon
Get-LocalGroupMember -Group Administrators | Measure-ObjectAn admin account you have never used is a theory. Reset the daily account's password from the backup account, sign back in with it, and confirm the elevation prompt accepts the backup credentials.
# sign in as the backup admin, open PowerShell as administrator
net user dailyuser "NewTempPassword!2026"
net user dailyuser | Select-String -Pattern 'Account active|Last logon'
# sign in as dailyuser with the new password, then set your own again
whoami /groups | Select-String -Pattern 'S-1-5-32-544'New-LocalUser creates enabled accounts, but a policy can disable them. Enable it with Enable-LocalUser -Name 'AdminBackup'.
Check the group membership with Get-LocalGroupMember. A typo in the group name silently creates nothing.
The default policy requires complexity, not length alone. Mix case, digits and a symbol, or change the policy for this local account.
A PC reset removes local accounts. Keep the account on machines you maintain long term and recreate it after every reinstall.
Only if it is used daily or has a weak password. An unused account with a long passphrase adds a recovery path without adding exposure.
Yes, but a local account is the better fallback because it does not depend on the network or on Microsoft's sign-in service.
Then the recovery environment and a Windows installation medium are the only route. That is exactly the situation this account prevents.
Remove the account with Remove-LocalUser -Name 'AdminBackup'. Make sure another administrator exists before you run it.
Free · no account needed · tracks your progress