Skip to content
Zepe

Accounts and security

Windows account management is confusing largely because three different names are attached to every account — the display name you see on the sign-in screen, the underlying account name, and the user profile folder on disk — and changing one does not change the others. A great deal of bad advice on this subject comes from not distinguishing them.

This section keeps those layers apart. It also takes a firm line on the security guides: turning Defender off, turning the firewall off and removing a login password are all legitimate things to want to do, and each guide explains how, but each also states what you are giving up and how to put it back.

Nothing here covers bypassing a password you do not know, recovering someone else's account, or working around activation. Those are the questions this site declines to answer.

What you'll learn

  • The difference between a display name, an account name and a profile folder path, and how to change each one
  • How to add and remove local and Microsoft accounts, including creating an offline account on a modern install
  • Why Windows Defender turns itself back on, and how tamper protection and exclusions really work
  • When turning off the firewall is reasonable and when allowing a single application through is the better answer
  • What your options actually are for encrypting a folder on Home versus Pro editions

7 guides in accounts and security

  • How to Password-Protect a Folder in Windows

    The honest options for encrypting a folder on Windows Home and Pro — 7-Zip AES-256, BitLocker and EFS compared, and why the batch-file locker scripts do nothing.

    Accounts and securityUpdated

  • How to Turn Windows Defender On or Off

    Turn Microsoft Defender real-time protection on or off, add folder exclusions, and understand why it switches itself back on after a restart.

    Accounts and securityUpdated

  • How to Turn Off the Windows Firewall

    Turn the Windows Defender Firewall off per network profile or with netsh, and why allowing a single app through is nearly always the better answer.

    Accounts and securityUpdated

  • How to Create a New User Account in Windows 10

    Add a local or Microsoft account in Windows 10 and 11, including the offline-account workaround, and choose correctly between standard and administrator.

    Accounts and securityUpdated

  • How to Delete a User Account in Windows 10

    Remove a user account in Windows without losing their files, why you cannot delete the last administrator, and how to clean up the leftover profile folder.

    Accounts and securityUpdated

  • How to Change the Administrator Name in Windows 10

    Rename a Windows account properly — display name, account name and the user profile folder are three different things, and only two of them are easy to change.

    Accounts and securityUpdated

  • How to Change Your Windows Password or PIN

    Change or remove a Windows 10 and 11 password or PIN, understand why a PIN is usually safer than a password, and what removing sign-in actually costs you.

    Accounts and securityUpdated

Questions about accounts and security

Why does Windows Defender turn itself back on after I disable it?

Real-time protection is designed to re-enable after a period or a reboot unless another registered antivirus has taken over. This is deliberate: the toggle is meant for a short diagnostic window, not a permanent state. Tamper protection also blocks registry-based attempts to make the change stick.

Can I delete the built-in Administrator account?

No, and you generally should not want to. The built-in Administrator is a protected account that Windows keeps disabled by default on consumer installs. What most people mean is deleting a different account that happens to have administrator rights, which is fine as long as at least one administrator account remains.

Is a PIN less secure than a password?

In practice it is usually more secure, which surprises people. A Windows Hello PIN is bound to that one device and backed by the TPM, so it is useless to anyone who steals it remotely. A Microsoft account password works on any machine and on the web, so exposing it is far more damaging.

Related topics

See all 8 topics →