Using same password for both Local Admin and Standard accounts?

Hi everyone!

Just need some user account advise here.

-I am the only person using my machine and no one else.
-Machine is a Standalone meaning it is not domain-joined.
-Running BitLocker full encryption with TPM and PIN
-User account lockout after failed password attempts are Enabled
-Password is long and complex
-UAC for both local Admin and Standard accounts are set to Prompt for Credentials on the Secure Desktop

Here is my question, can I use the same password for both Admin and my Standard accounts?


.

Why should I not use the same password for both accounts?

I’m the only one using the system and rarely login to my Admin account.

I can understand using a different passwords for business environments with many users, but I’m the only one using my machine.

Using my standard account for daily work.

Why do you ask this?

Because sometimes I just need to lock my laptop without shutting down.

Might be the reason you asked because I have a BitLocker PIN as well. But it only ask this when powering on my laptop.

- - - Updated - - -

In my case from my original post, is it fine to use the same password for both Admin and Standard accounts?

win10freak said:

Why should I not use the same password for both accounts?

I’m the only one using the system and rarely login to my Admin account.

You should not use the same password because that's almost the same thing as not having standard user account but just using administrative account.

There is a technique call "privilege escalation", and if you have same password you'll make attacker's job easier.

Using my standard account for daily work.

Keep in mind that for this to be most effective you need UAC maxed out, this way "privilege escalation" scenario is less likely.

If having separate password for each account is such a problem, make your standard user account password short, ex. max. 5 characters, because loosing control of standard account isn't problem at all for local system; important is that Admin account is min. 8 chars with complexity policy in place. (loosing Admin account means loosing everything else)

If you want to go one step further and make your accounts even more safe make sure user accounts are not enumerated during login or UAC approval.

Also important step is to prevent keyloggers from capturing your password as you type them, to ensure this does not happen never use hardware keyboard for UAC or login prompt, use virtual keyboard instead.

If you use remote access to your computer make sure CTRL + ALT + DEL is required prior to logging in.

Thanks for the detailed explanation.

I just set a different password for my Admin account.

I set the UAC for the Standard account to Prompt for Credentials on the Secure Desktop.

Recently, I did set all user accounts to not show on the Windows login screen meaning that I would have to type in my username and password.

However, when I just lock my screen, it does show my username. Would that be an issue?

I know there is also a group policy to not show the username when session is locked, but is it really needed?

All other login or sign-in methods do not show username, only when I just lock my laptop.

Here is a complete solution:

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Interactive logon: don't display username at sign in (Enabled)
Interactive logon: Do not require CTRL+ALT+DEL (Disabled)
Interactive logon: don't display last signed-in (Enabled)
Interactive logon: Display user information when the session is locked (Do no display user information)
User Account Control: Behavior of the elevation prompt for standard users (Prompt for credentials on the secure desktop)

Computer Configuration\Administrative Templates\Windows Components\Credential User Interface
Enumerate administrator accounts on elevation (Disabled)

If in addition you want to see solid background on logon screen then:

Computer Configuration\Administrative Templates\Control Panel\Personalization
Do not display the lock screen (Disabled)
Prevent changing lock screen and logon image

Many thanks for this!

It’s interesting, because if no username is shown on the login or Lock Screen session, then it’s still rather easy for a user to find out the username once after signing into the machine, such as in the C\Users directory, the CMD prompt, and from among many other locations.

Since I will not remotely access my laptop and also have Remote Desktop disabled, do I really need the CTRL+ALT+DEL policy to be set?