On Windows, what is the default behavior of the built-in administrator account with respect to lockout?

• A. The original admin account cannot be locked out by default.
• B. The admin account is always locked out on login failure.
• C. The admin account is exempt from any policy.
• D. The admin account is locked out unless a domain policy overrides.

Answer: (A)

The main idea is that Windows treats the built-in local Administrator account as a special case for logon security. By default, this account is exempt from the account lockout policy, so it cannot be locked out due to failed logon attempts. This safeguards the most privileged account, ensuring you always have a way to recover or manage the system even if lockout settings would otherwise block access. You can still secure or disable/rename this account for security, but it won’t be locked out by default. In domain environments, domain accounts follow domain lockout rules, but the local built-in Administrator account remains protected from lockout by default.