Windows UAC and Local admin rights

User Account Control (UAC) is a security feature in Windows that helps prevent unauthorized changes to your computer. It was introduced in Windows Vista and has been an important security mechanism in all versions of Windows since then. UAC works by prompting the user for permission before allowing any action that requires administrative privileges.

UAC is an important security mechanism in Windows that helps protect your computer from unauthorized changes and malware. Turning off UAC is not recommended and can make your computer vulnerable to attacks. It is always better to keep UAC enabled and take extra precautions to protect your system from potential threats

But when it comes to local admin rights even with UAC enabled you should still split these local rights to another account.  A users everyday account should have little to no extra permissions then want is needed for the everyday work they do.

But they are times when having these rights are a positive as it gives users flexibility and faster response to install software and updates without the need of IT support, this brings more user autonomy and lowers the involvement of IT support.

Given a user a local admin account just for admin tasks while also maintaining a normal account is the best of both words when it comes to user autonomy and security.

Resetting Windows 10 password without a local admin account

Sometimes due to company policy local admin accounts are not allowed and if a device is removed from the domain in the wrong order you can paint your self in a corner.

Best hope is to reset and enable the Administrator account or if someone made a local admin but then forget the password with:

Download | Hiren's BootCD PE

If you don't need access to the data then Downloading Windows 10 and reinstall may also be a better option

Quick command line for making a local admin account

 Sometimes with remote tools you have remote screen access with software such as TeamViewer or ISL Light.

and at times you also have a remote command line interface too but no local admin account to get in to a desktop.

open the command line CMD or remote command line tool and type

net user admin-tmp <Password> /add
net localgroup administrators admin-tmp /add

If you need to view a list of local users type

net user

and to check a local accounts password

net user <Name> <Password>

To delete accounts

 net user <Name> /delete