7

What are the risks of not setting up a password for the admin user (the only user) in Windows 10? Besides physical attacks, are there any network vulnerabilities? Or maybe encrypted data is more exposed?

Will an Anti-virus suite be enough to compensate?

Edit:

A bit of background: This PC is not mine, it's from an elder with a little bit of disabilities to type in a keyboard, so I am trying to balance security and ease of usage.

3
  • 2
    Would your friend be as resistant to having a password, but not needing to use it all the time? You can set the machine to auto login at boot. If you use local passwords & don't use MS's online services, there may be no other occasion a password is actually needed.
    – Tetsujin
    Jul 14, 2020 at 7:13
  • discussed and answered here>>>>>security.stackexchange.com/questions/188870/…
    – Moab
    Jul 14, 2020 at 11:56
  • That answer talks about fraud, specially for enterprises and physical invasions, which as I said, it's not my case and I don't care about.
    – mFeinstein
    Jul 14, 2020 at 12:17

5 Answers 5

7

With no physical access, you have some protection. If someone were able to access by RDP (network access that you spoke of), it is reasonable that your main user will show up in the login list and then the person has access.

As pointed out in the other post, once a person has access as administrator, they can do anything they wish.

I always recommend a strong password for these reasons and follow my own advice.

2
  • 7
    It used to be that Windows would not allow remote access to accounts with no password, IIRC. Is this still the case?
    – user253751
    Jul 14, 2020 at 12:43
  • I think it depends on the method of remote access and the settings in the Windows Advanced System Settings.
    – John
    Jul 14, 2020 at 12:46
3

Last time I checked, setting the password to blank offered some really good security properties.

  1. If somebody got access as a service account, that person would be unable to elevate to the user account because blank passwords are refused in that security context.

  2. Login over RDP doesn't work for the same reason.

  3. Login over UNC shares doesn't work for the same reason.

But if somebody got in front of the computer, the front door is wide open. Same if VNC or TeamViewer are permanently installed.

3

Yes. If someone has a physical access to your computer, he or she can turn on your computer and access in the only administrator account. Then they will get the power to everything with the system. Also if a malware is installed on the Administrator account, then it will run with more privileges than being run on a standard account, then it will do more harm to your computer. Also, this risk is more in schools, colleges, universities and organisations, where more important data is stored in the computer. Also, more people access the computers and it will be a large and open security backdoor.

There are also network vulnerabilities. You can be exploited with tools like Metasploit framework, over the network. And basically, if you have allowed remote desktop host on your computer, then anyone can connect with RDP protocol and access your computer as he was sitting on his own computer over network. But physical vulnerabilities are more. So you should protect Administrator and also standard accounts with a strong password, an did possible use drive encryption methods like bitlocker.

6
  • As I said, I don't care about physical access
    – mFeinstein
    Jul 14, 2020 at 2:09
  • 2
    Read the answer properly, you will also find network vulnerabilities.
    – Wasif
    Jul 14, 2020 at 2:10
  • 5
    Yes, but you put so much effort on something that I clearly said I don't care about.
    – mFeinstein
    Jul 14, 2020 at 2:11
  • @mFeinstein If you don't care about the security, why did you ask it here? What are you protecting against? Just malware?
    – Mast
    Jul 14, 2020 at 12:44
  • 3
    I don't care about physical security as the computer is at home alone, but I care about malwares and networks as someone on the same network (an infected phone over Wi-Fi) could attack that computer.
    – mFeinstein
    Jul 14, 2020 at 12:49
-1

Oh my, it's like opening the door to fort Knox. You've lost all the security that has been placed by not having a password, even a simple one.

If you go to a website that places malicious software on your device, and you go and turn the pc/laptop off, then they can turn it on and easily access anything they want. That happened to my Lenovo, so i had to get a factory reset and lose all my data. Even having "1234" is better than nothing as there is device-specific encryption that goes into Windows 10.

2
  • Yes, but it's not for me, it's for someone else who already has a good anti-virus installed, I just need info to prove to him that he needs a password as well
    – mFeinstein
    Jul 14, 2020 at 2:28
  • @mFeinstein, if you want to prove to that person he needs a password, then i suggest you learn how to hack and hack his pc/laptop. Unfortunately, i cannot bring proof, but with the knowledge that i have, the response i gave should be sufficient proof. Jul 14, 2020 at 3:19
-1

What you propose is equivalent to not locking your house when nobody's home, or buying an expensive sports car and then modifying it to use a push start and not need any kind of key to either get in or start the car.

There are ways that this can be made kind of secure (namely, turn off all remote access and all network services provided by the system, which also means you cannot share files from it over the network, among other things), but that still doesn't deal with the issue of physical security.

Now, before you start on the same kind of comments you've made on other answers about the computer being in a personal residence, I would like to point out that that is not even remotely good physical security unless you either keep the room it's in locked whenever you're not in it or never have any guests at your house. The fact that you've got no password means that accessing the system requires no more effort than being in the same location, and unless your paranoid or a social recluse, it's rather likely that you have more than a few people over at your house at times and do not always know exactly where each of them is.

And this really reinforces why even having a bad password is important. By just having one you prevent people from just casually accessing your system. For most people, just that tiny bit of extra effort is sufficient to prevent them from even considering trying to access your computer without your permission.

7
  • 1
    The computer is not mine, is from an elder person, so I am balancing security with ease of access. Complex passwords are fine for you and me, but even a simple password can be cumbersome for an elder.
    – mFeinstein
    Jul 14, 2020 at 15:01
  • @mFeinstein Then get compatible hardware (fingerprint reader of a good camera with IR illumination) and set up Windows Hello properly. The issue here isn't the need for a password specifically, it's the need for some form of proof of authorization to access the system. Given that the primary user is elderly, this gets all that much more important, as they're likely to be a prime target for scams and other social engineering based attacks. Jul 14, 2020 at 15:52
  • Hardware doesn't protect you from scams. I am trying not to buy more stuff, specially webcams as they are all of stock where I live because of the pandemic. So I am asking in order to balance the risks and understand all possible outcomes.
    – mFeinstein
    Jul 14, 2020 at 15:54
  • The primary risk here is probably the possibility of elder abuse (that is, a caretaker getting access to the system without prior authorization and using that to do things they shouldn't with finances or similar things). You can't completely protect against that (they could trick the user into unlocking the system), but you can make it much more difficult by requiring some form of authentication for access to the system. Chances are that the existing hardware supports PIN-based Windows Hello usage, which is still better than nothing. Jul 14, 2020 at 16:00
  • 1
    There are no caretakers, the elder is not technology savvy and has a crooked fingers (osteoarthritis), but lucid and strong, lives with his wife and they can take care of themselves. But I appreciate your concern.
    – mFeinstein
    Jul 14, 2020 at 16:07

Not the answer you're looking for? Browse other questions tagged .