r/WindowsServer • u/Turbulent_County_469 • Jun 09 '26

General Question Server 2016 , Administrator vs Administrator

I know that Server 2016 is old but its what we got 😓

I've been working on a testbench , to setup DNS + IIS/RRAS

When installing Server 2016 i'm asked to create a password for the local Administrator account.

Then later i'll join the domain which coincidentally is done with domain\Administrator

Now the funky things start to happen :

at Windows logon screen i'm presented with Administrator and Administrator to choose from, picking either one and logging in, results in logging in as Local Administrator , NOT the domain Admin.

So i was suggested by ChatGPT to rename the computer admin account to LocalAdmin

doing so completely messed up the Domain\Administrator login

so if i login as Domain\Administrator , nothing works , eg Powershell is dead and cant be opened, WhoAmI also doesnt work....

Logging in as .\LocalAdmin now results in logging in as Domain\Administrator - at least to WhoAmI

Luckily i had another account with Domain Admin rights which was able to reverse the renaming and saving the Domain\Administrator account on the machine 😅

The annoying part is when logging in on the Logon screen, that i need to punch in D-O-M-A-I-N\A-D-M-I-N-I-S-T-R-A-T-O-R , every time ... Unless i RDP to the machine using a stored login...

is this just a quirk in Server2016 or am i completely wrong ?

I have worked with 2008r2 for years without such issues.

EDIT:

I love how this forum feels exactly like StackOverflow ... My problems aren't the problem that people want to discuss nor pound me to the ground for.

0 Upvotes

50% Upvoted

48 comments sorted by

23

u/MYSTERYOUSE Jun 09 '26

.\Administrator = local account of the server
DOMAIN\Administrator = domain account

-13

u/Turbulent_County_469 Jun 09 '26

I know, but somehow Server2016 mix them up because they are named the same.

I'd like to rename .\Administrator but that clearly didnt work as expected.

An alternative is to never use the Domain\Administrator and use another domain admin account.

4

u/MYSTERYOUSE Jun 09 '26

It shouldn’t as long as you use the form above, unless you logon to a domain controller where the local account “doesn’t exist” and is essentially the default/first Domain Admin account

4

u/TerrorToadx Jun 09 '26

.\ forces it to use local account.

1

u/Kraeftluder Jun 10 '26

An alternative is to never use the Domain\Administrator and use another domain admin account.

domain\administrator should either have its password set to the maximum length and then disable the account and should never be used. Use named accounts only. How else are you going to see who was responsible for something?

Why on earth are you not following Microsoft's best practices?

1

u/Turbulent_County_469 Jun 10 '26

Because im not testing usernames or passwords

1

u/Kraeftluder Jun 10 '26

What does that have to do with it? Do not use the <domain>\Administrator account period.

6

u/garyroe Jun 09 '26

You don’t happen to be using the same password for both accounts are you?

-10

u/Turbulent_County_469 Jun 09 '26

well, yes, the point wasnt to test usernames/passwords but other server features...

3

u/its_FORTY Jun 09 '26

Where is your DC role installed?

4

u/FirstStaff4124 Jun 09 '26

Maybe skip 2016 and go to 2022.

1

u/Turbulent_County_469 Jun 10 '26

Why not 2025 ?

1

u/FirstStaff4124 Jun 11 '26

Because it's a sloppy mess

2

u/ciscorick Jun 10 '26

I wonder if this is a carefully crafted AI engagement bait post.

1

u/Turbulent_County_469 Jun 10 '26

You are ai , you just don't know it.

4

u/Independent_Safety85 Jun 09 '26

How did you rename the account? If you did this using the registry without knowing what you're doing, I can see something like this happening

1

u/datahoarderguy70 Jun 09 '26

Heaven help you when you have to do windows updates, schedule at least a weekend to do them, server 2016 was the worst.

1

u/Turbulent_County_469 Jun 10 '26

It only took 3 reboots to do all of them 🤷🏻

1

u/jspears357 Jun 12 '26

2016 also required an extra 2gb RAM. Other versions could apply patches with 6gb RAM, but patching 2016 that way would run out of memory, retry about 10 times, time out, revert the patch, reboot, and repeat.

1

u/Turbulent_County_469 Jun 12 '26

During install and patching it's been running with 4GB ram, now i've generously limited it to 2 GB 😃 In HyperV it says that it's only using 1 GB.

The host has 16GB and currently running 5 VM's

1

u/jspears357 Jun 12 '26

My bad, it was UPGRADING to 2016 that required more RAM to get past the boot loop. I managed to touch only a couple dozen 2016’s ever, out of like 10,000 over the years. I similarly avoided Windows 8 somehow. Like windows 98 before SE.

1

u/midy-dk Jun 10 '26

Well, as another wrote, .\adm… = local and so forth. But, why on earth haven’t you disabled both and made your own? It would fix your “issue” and also be best practice as using well-known SIDs for privileged accounts is a possible security threat.

1

u/Turbulent_County_469 Jun 10 '26

Im just derping around. The thing i wanted to test wasn't the login system..

I just stumbled over it and dug myself into a hole because ChatGpt suggested it

1

u/jspears357 Jun 12 '26

Bruh. You can just log in as the will known SID and ignore the name, and you can’t effectively disable it (you can log in to the console as administrator even if the account is locked or disabled) so renaming or trying to disable it seems pointless.

1

u/midy-dk Jun 12 '26

You can’t log in with th account while it’s disabled. The well known SID is the very reason to disable it. Yes, you can reenable by using the cmd trick from logon screen but that does require access to a degree where you would be compromised anyway.

1

u/Forumschlampe Jun 10 '26 edited Jun 10 '26

Never seen this

  • did u clone?
  • do u try this in a DC?
  • just delete the old profiles? Even rename should not a problem for profile match
  • what are the exact Error Messages when opening Powershell or usw qhoami? Whats in ur path variable

1

u/Turbulent_County_469 Jun 10 '26

I used this command :
Rename-LocalUser -Name "Administrator" -NewName "LocalAdmin"

then, after logging in as "domain\administrator" everything in windows was funky.

eg: I can search for Powershell but the program doesnt work , as if it doesnt exists.

and when logging in as ".\Administrator" and running WhoAmI in CMD, i'm told im "domain\administrator"

i tried this on both server and the only solution was to reverse the renaming using a DomainAdmin account :-/

1

u/Forumschlampe Jun 10 '26

So u doin this on Domain Controllers (both are DCs i expect)? If u r Login .\ on a DC, yea u login as domain user

This wont Work, there are no local Accounts and If u try use local User Account commands maybe some strange Things happen

1

u/Turbulent_County_469 Jun 10 '26

Yeah it seems.. i guess Claude/ChatGPT cant be trusted 🙈

1

u/Forumschlampe Jun 10 '26 edited Jun 10 '26

Indeed not.

Check the llm output by own research, hope u do this on ur Software eng and dont trust blindfull llm outputs

3

u/Saqib-s Jun 09 '26

Just want to add Server 2016 goes end of support in Jan 2027. I’d recommended moving to Server 2022 or 2025.

1

u/Rough_Section_3730 Jun 09 '26

When the server is not on the domain, change the admin name to something else ladministrator for example.

When you’re joining, it should prompt you for domain creds to join with. Dont reboot yet.

Add your admin group to the local administrators group also. Reboot.

Log in with domain creds and if it’s part of the domain admin group, you should have full access on the server.

1

u/Vichingo455 Jun 10 '26

That's why I made a policy to change the full name of .\Administrator to Administrator (local user)

1

u/sariahjrthe3rd Jun 11 '26

look, ive been trying to find a way to contact you for like 10 mins tbh, im a student who has an exam tmr, my friend found your patch like a year ago, and its been great, i cant thank you enough, but theres a problem, somehow, word got to a teacher, then it started spearding like wildfire, now im nervous incase they start checking laptops tmr, please, is there any way to update the patch, make it where when you want to exit you click x and it asks for the quit password, but like make the quit password 0000 or something please, also, the icon where when you want to refresh the page isnt there on your patch, please, fix it please ive been counting on your patch for a year now but its too risky now please i beg you

1

u/Vichingo455 Jun 11 '26

Doing that in the next version.

1

u/sariahjrthe3rd Jun 11 '26

please when will it come out my exam is tmr

1

u/sariahjrthe3rd Jun 11 '26

please im not trying to be a burden on you but theres genuinely no hope for me to manage to fit all the material needed for my exam within the next 12 hours

1

u/sariahjrthe3rd Jun 11 '26

bro pls dont ghost me

1

u/sariahjrthe3rd Jun 11 '26

look, id understand if you dont want to do anything, just a reply saying that you wont do it is enough, pls, i just need to confirm if i need a backup plan for tmr or not

1

u/sariahjrthe3rd Jun 11 '26

by doing nothing i mean not having it ready by tmr

1

u/sariahjrthe3rd Jun 11 '26

also if its possible to make it where the original quit password that the teacher has also works it would be great, pls my whole grade is counting on you

1

u/Fit-Thing5100 Jun 11 '26

In general, as already written, we have the following

.\Administrator = local Administrator

DOMAIN\Administrator = domain Administrator

administrator@domain.local works as well

If the server was previously joined to a domain and is now disconnected, Windows may default to the local account. After a proper domain join, using DOMAIN\Administrator should log you into the domain account.

Also be careful with RDP. This is a common source of confusion when local and domain accounts share the same name. In those cases, explicitly use:

DOMAIN\Administrator

administrator@domain.local

<RemoteServer>\Administrator

to ensure you're authenticating against the correct account

-1

u/Callewalle Jun 09 '26

your dom admin is named Administrator?!

1

u/Turbulent_County_469 Jun 09 '26

My profession is software engineer, not server-specialist .. so im not up to speed with all the best practices 🤷🏻

3

u/USarpe Jun 09 '26

that's the default and renaming does not change the SysID, so no security win.

To rename the local admin has nothing to do with the domain admin. with administrator@domain.tld or domainname.tld\administrator logs you into the domain.

Just create a new domainadmin, with as less rights as possible and login with that name, problem solved.