Administrator Account Confusion

[The Bronx Bull]

When deploying Windows 7, I'm a bit confused with regards to the Administrator account creation from a TS from within SCCM. That confusion probably stems from the "Randomly generate the administrator account and disable the account on all supported platforms (recommended)" option from within the "Apply Windows Settings" of my task sequence.

 

Why would that be recommended? I have yet to work within an Enterprise environment that ONLY uses domain accounts and has no backup/local admin account.

 

My goal is this: Immediately after OSD, I want ONE local administrator account on the PC, I want it to be called "lionadmin", and for the password to be specified in the task sequence. That's it.

 

I realize you can create accounts within the Unattend.xml file, but if I do so there, what should I choose in the "Apply Windows Settings" step of the task sequence? The way I have it set up now, it seems to be creating my "lionadmin" account properly, but there is an additional "Administrator" account that is disabled by default.. if I choose "Randomly generate the administrator account..", and for whatever reason the PC fails to join the domain, then I'm locked out for good.

[Lucid]

Just tossing this out there for whatever it's worth...

 

One of the reasons it's recommended that the built-in "administrator" account be disabled is because everything has a SID, and the SID for that account is the same - so all the hackers and viruses already have half a foot in the door (http://support.microsoft.com/kb/243330). But yeah, many environments don't bother disabling it.

 

It's up to you which way you go, but if a machine you imaged doesn't join the domain, then something errored out, so why would you try to log in and fix the machine? You can always use WinPE to boot up and pull log files.

 

And some environments may rely on the TS instead of the .XML because they want one .XML file, but may require different local accounts to be created for various departments (FinanceAdmin, HRAdmin, TechAdmin, etc...).