0X0000055D

ERROR_SPECIAL_USER 0x55D: Fix Built-in Account Lockout in Windows 10/11

EP
Erropedia Team
📅 August 5, 2026 📅 Updated Aug 6, 2026 👁 4 views Windows Errors Intermediate
Hitting 0x55D when touching built-in accounts like Administrator? It's Windows protecting them. Here's why and how to fix it.

You're in the Local Users and Groups snaplet (lusrmgr.msc) or maybe tweaking a service's logon account, and you try to rename or disable the built-in Administrator or Guest account. Windows stops you cold with ERROR_SPECIAL_USER (0x0000055D). This error also pops up when you try to change group membership of those accounts, or when a script tries to set a password on them. It's frustrating because the settings look editable, but Windows slams the door.

Why Windows blocks you

Windows treats a handful of accounts as "special" because they're hardcoded into the OS's security model. The built-in Administrator (SID S-1-5-21-...-500) and Guest (SID ...-501) have fixed SIDs and reserved roles. Microsoft deliberately locks them down so you can't accidentally lock yourself out of your own machine. The error is Windows saying, "I won't let you modify this account's core properties because it would break the system's trust boundary."

Here's the kicker: you can still rename these accounts, but you have to do it the right way. Going through the UI or using net user sometimes triggers the protection. The registry and Local Security Policy tools bypass that check, which is why those are the reliable paths.

Fix: rename or modify the built-in account correctly

Skip the GUI shortcut, use these methods instead. They respect the account's integrity while still letting you make changes.

Option 1 – Use Local Security Policy (easiest for rename)

  1. Press Win + R, type secpol.msc, hit Enter.
  2. Go to Security Settings → Local Policies → Security Options.
  3. Find Accounts: Rename administrator account and Accounts: Rename guest account.
  4. Double-click the policy, type the new name in the value field, click OK.
  5. Reboot or run gpupdate /force in an elevated command prompt.

This is the official way, and it survives reboots. The rename actually changes the account name in the SAM, but Windows allows it through the policy layer.

Option 2 – Registry edit (for when you also need to change the description or disable)

The registry holds the actual display name. Careful here—this is advanced. If you mess up, you could have trouble logging in.

  1. Open regedit.exe as Administrator.
  2. Go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList.
  3. If you want to hide the account from the login screen, create a DWORD value with the account name (e.g., Administrator) and set it to 0. To show it again, set to 1.
  4. For renaming, you actually need to edit the ProfileList or the SAM directly—which I don't recommend. The policy method is safer.

Most people hit this error when trying to enable the built-in Administrator. That's a different mistake. Read on.

Option 3 – Enable the built-in Administrator properly

If you're getting 0x55D while trying to enable the Administrator account via net user administrator /active:yes, here's the workaround:

// In an elevated command prompt, run:
wmic useraccount where name='Administrator' set disabled=false

That command bypasses the special-user protection. Or, if you're on Windows 10/11 Pro, use Local Security Policy's Accounts: Administrator account status to enable it. That's the cleanest route.

Still stuck? Check these three things

If the error persists, you're not doing anything wrong. Windows might be holding a deeper lock.

  • Are you running as a real Administrator? Being in the Administrators group isn't enough. Right-click your command prompt or PowerShell and choose Run as administrator. The elevation token matters.
  • Is the account actually in use? If you're logged in AS that built-in Administrator, Windows sometimes refuses to rename or disable it until you log off. Switch to another admin account first.
  • Group Policy from your domain/company? If your PC is joined to a domain, a policy might be overriding your changes. Run gpresult /h gp.html and look for any policy that restricts built-in account modifications. If so, you'll need your IT admin to adjust it.

The last resort is a full repair install of Windows using the ISO's setup, but that's only if you've corrupted something in the SAM. In my years of support, I've only seen that once—someone manually edited the registry to rename the account and broke the login. Don't be that person.

Stick to the policy method for renames, and you'll never see 0x55D again.

Related Errors in Windows Errors
0XC01A001C STATUS_LOG_TAIL_INVALID (0XC01A001C): Fix the Active Log Base Error 0X80094010 Fix CERTSRV_E_ALIGNMENT_FAULT 0x80094010 Event Log Service Won't Start — Fix in 2 Minutes 0X000002F6 Fix ERROR_NOTHING_TO_TERMINATE (0x000002F6) on Windows 10/11
ERROR_SPECIAL_USER 0x55D built-in special user Administrator account Windows error cannot perform operation special user error fix Windows error registry edit local security policy account lockout

Was this solution helpful?

EP
Erropedia Team
Tech Support Editors
The Erropedia editorial team researches and documents real-world tech errors from across Windows, Linux, macOS, networking, databases, cloud platforms, and more. Every solution is reviewed for accuracy and updated as software and systems evolve.