Why Local Account Cannot Run Administrator Tasks on Windows 11

Quick fix: Open Settings → Accounts → Other users → [local account] → Change account type → Administrator. If the account is the only one on the PC and you can’t change its type from itself, boot to Safe Mode and use the built-in Administrator account, or run net localgroup administrators <username> /add from an elevated Command Prompt.

You set up a local user account (no Microsoft Account) and now it can’t run installers, can’t open Terminal (Admin), can’t change system settings. The account is a Standard User; admin tasks require an Administrator account. Promoting a local account to admin takes two clicks — or one PowerShell command for the case where you’ve locked yourself out of even Settings.

What causes this

Windows accounts have two types: Standard User (can use the PC but can’t change system settings or install apps) and Administrator (full system rights). When you create a new local account via Settings, it’s Standard by default. UAC prompts that ask for admin credentials are asking for an account that has Administrator type. If your account doesn’t, you can’t self-approve.

There’s also a built-in Administrator account that’s disabled by default on Home/Pro. It can be enabled in emergencies as a path to elevation when you have no other admin account.

Method 1: Promote the local account via Settings (if another admin exists)

The standard route. Requires an admin account to perform the promotion.

1. Sign in as an existing Administrator account (the one that was created during initial Windows setup, or another admin you set up).
2. Open Settings → Accounts → Other users.
3. Find the Standard User account. Click to expand it.
4. Click Change account type.
5. In the dropdown, pick Administrator. Click OK.
6. Sign out of the admin account. Sign in to the now-promoted account. It can now run admin tasks directly.
7. If you only have one account on the PC and it’s Standard, this method doesn’t work — you can’t demote yourself to non-admin AND can’t promote yourself without another admin. Skip to Method 2.

The trade-off: grants full admin rights. For shared PCs, consider using a separate admin account for system tasks and a Standard account for daily use.

Method 2: Enable the built-in Administrator account in Safe Mode

For when you have only one Standard account and can’t promote it.

1. Boot into Safe Mode: Settings → System → Recovery → Advanced startup → Restart now. After reboot, choose Troubleshoot → Advanced → Startup Settings → Restart → press 4.
2. In Safe Mode, sign in as your usual account.
3. Right-click Start → Terminal (not Admin since you don’t have admin). Or open Command Prompt.
4. Even without admin, in Safe Mode you can run:

   net user Administrator /active:yes

   This enables the built-in hidden Administrator account.

5. If access denied: try with the elevated Terminal — Safe Mode sometimes allows this. Right-click Terminal → Run as administrator.
6. Reboot. The Administrator account appears on the sign-in screen.
7. Sign in as Administrator (no password by default).
8. From this account, open Settings → Accounts → Other users → find your usual account → Change account type → Administrator.
9. Sign out, sign back in as your usual account. You’re now an admin.
10. Disable the built-in Administrator for security: net user Administrator /active:no.

This is the emergency path when you’ve locked out admin from your only account.

Method 3: Add to administrators group via PowerShell or net command

For sysadmins or scripted scenarios.

1. Need an existing elevated terminal (admin Command Prompt, admin Terminal, or PowerShell run as admin).
2. List current administrators:

   net localgroup administrators

   or in PowerShell:

   Get-LocalGroupMember -Group "Administrators"

3. Add a user to administrators:

   net localgroup administrators YourUsername /add

   or:

   Add-LocalGroupMember -Group "Administrators" -Member "YourUsername"

4. For Microsoft Account-backed accounts, use the email-based identifier or the local profile name (usually a truncated version of the email).
5. To remove admin rights later:

   net localgroup administrators YourUsername /delete

6. The user must sign out and back in for the change to take effect.

This is the scriptable path. For unattended setup of multiple PCs, automation via Group Policy or Intune is the right approach.

How to verify the fix worked

• Right-click Start → Terminal (Admin). The UAC prompt shows the elevation request and you can click Yes directly without entering a different account’s password.
• Run whoami /priv in elevated Terminal. Output lists privileges including SeBackupPrivilege, SeRestorePrivilege, etc., confirming admin tier.
• Run net localgroup administrators. Your username appears in the membership list.

If none of these work

If the built-in Administrator is also disabled or doesn’t appear after enabling, the SAM (Security Account Manager) database may be corrupted. Boot from Windows install USB: choose Repair your computer → Troubleshoot → Command Prompt. From here you have system-level access and can run net user commands to enable accounts or reset passwords. For Microsoft Account-only setup: if you signed in with a Microsoft Account, you can reset the password at account.microsoft.com. The account type at the PC remains the same (Standard or Admin), but you regain access. For domain-joined PCs: local administrator promotion may be disabled by Group Policy. Contact IT. Last resort for locked-out PCs: Reset This PC → Keep my files. Refreshes Windows including SAM database, allowing fresh account setup. Data files are preserved but installed apps are removed.

Bottom line: Settings → Accounts → Change account type promotes Standard to Administrator. For only-Standard PCs, enable the built-in Administrator from Safe Mode as a recovery path.