Undo Built-in Administrator Account tied to a Microsoft Account

Kari said:

No, that will not fix it.

I've been testing this now quite extensively because I found something that makes me worried; as of version 1709 it is now possible to use UWP apps also when signed in as built-in admin. This was not possible earlier. If tried, an error message like below was shown:

Attachment 167622

Now, with full access to UWP apps it means that, although it still is not possible to switch built-in admin account to a Microsoft account from Settings > Accounts, it is now possible to sign to UWP apps with MS account when signed to Windows as built-in admin and from there switch the system account to a Microsoft account when choosing wrong:

Attachment 167623

In my opinion this is a serious error, something that should not be possible and allowed.

When the built-in admin account has been connected to a Microsoft account, the only way to revert it, switch back to a local account is a clean install. The link to switch to a local account is simply missing:

Attachment 167619

For repair install, there's nothing to repair; the account is OK and working.

Kari

I agree this is an issue. It seems like some developer decided to sort issue about running uwp apps in Administrator mode but only did half the job.

I wonder what happens if you do a sysprep and oobe in audit mode ? One to test in a vm .

cereberus said:

I wonder what happens if you do a sysprep and oobe in audit mode ? One to test in a vm .

In my tests, if you install without network connection, boot to Audit Mode signing in as is default with built-in admin credentials, and only then enable network, you can install new UWP apps from Store as you wish. They will not get provisioned to all users, they do not prevent generalizing with Sysprep.

The key seems to be, according to few tests installs and Sysprep runs I've done, to install without any network / Interwebs access.

lx07 said:

I don't understand this.

Either the Administrator account is linked on the MS servers (in which you can't do anything and clean install would not help) or it is held on your PC (in which case you can change it).

If clean install resets it then clearly one can - it is just a matter of knowing how.

That's not how Microsoft account works.

An example: to get user profile named as I prefer, I always install Windows and set it up with a local account Kari. Then when on desktop, I will switch to a Microsoft because I prefer using MS account, initial account being set up as local (offline) account only for the reason I mentioned, to get user profile named as I wish.

According to your theory, I shouldn't need to manually switch to a Microsoft account after a clean install because that same local account on the same machine has already been connected to certain Microsoft account after every clean install.

That is really not true. All local accounts, be it user created or system account will always remain local with no connection to any MS account possibly used earlier on same PC by same local account username, until user manually switches to Microsoft account. Windows does not do it automatically, a local account will never be switched and connected to a Microsoft account without user interaction.

Kari

I will unsubscribe after posting this:

lx07 said:

Indeed - try to make an account called "Administrator" and you will find you can not.

The Administrator account is disabled when clean installing. When it will be later enabled, it will not switch to a Microsoft account even if it was switched in earlier installs on same machine.

lx07 said:

You are trying to be clever but the issue is not "should it be possible". If clean install rectifies a problem then it can be rectified without - something can be updated.

So you mean that absolutely each and every issue can always be resolved, making clean install basically unnecessary because according to you if clean install can resolve an issue, then it is also possible to resolve it without clean install.

That "trying to be clever", I was going to say that I take it as an insult, but then I thought that If you mean with it that I stated facts, not a theory, then yes I was trying to be clever. Difference between our posts regarding this matter is that I have tested this in all possible scenarios I could think of, have researched the issue, have broken registry in pieces and restored several system images to start again from scratch, whereas you've posted following the excellent "I think so therefore it must be true" principle.

lx07 said:

Just because you (or I) don't know how doesn't mean it is impossible. Obviously it is.

Please believe me, I know how hard it is to admit being wrong. I know you will not admit it, therefore this conversation is quite useless. However, as I feel it is important that we post facts about various Windows features and bugs rather than sophisticated theories, I will repeat this one more time:

If the Windows 10 native built-in administrator account has been switched to a Microsoft account, it can't be switched back to local account, nor can the connected Microsoft account email be changed. Clean install is the only way to do it.

A clean install is as the name say a clean install. Everything is reset to Windows defaults, no links or connections to any user specific Microsoft accounts will be automatically created. It always needs user interaction, be it as simple as setting Windows 10 up with a Microsoft account, connecting to one later, or enabling built-in admin account and then switching / connecting to a Microsoft account.

Kari