Fix 0X00000994: Can't Disable Last Admin Account

Quick Answer

You're getting error 0X00000994 because Windows won't let you delete or disable the last account with admin rights. The fix: enable the hidden built-in Administrator account first, then you can disable or delete the account you wanted to remove. After that, disable the built-in one again if you want.

Why This Happens

This is a safety mechanism that's been in Windows since NT 4.0. Microsoft figured that if you lock yourself out of all admin accounts, you're hosed. So Windows quietly refuses the operation with error code 0X00000994 (which maps to NERR_LastAdmin). The trigger is almost always someone trying to disable a local admin account in Computer Management or via net user when that's the only admin-eligible account left. I've seen this bite people on Windows 10 Pro, Windows 11, and Server 2019/2022 — classic mistake when cleaning up old accounts after a domain migration.

Fix Steps

Enable the built-in Administrator account. Open Command Prompt as admin (Win + X → Terminal (Admin)). Run:
```
net user administrator /active:yes
```
Set a strong password too:
```
net user administrator YourNewPassword123
```
Log out and log into the built-in Administrator account. You'll see it on the login screen now.
Disable or delete the target admin account. Use Computer Management (Win + X → Computer Management → Local Users and Groups → Users). Right-click the account → Properties → check "Account is disabled" for disable, or right-click → Delete to remove it. Or use the command line:
```
net user TargetAccount /active:no
```
Re-disable the built-in Administrator (optional). If you don't want that account visible anymore, run from the target account or another admin:
```
net user administrator /active:no
```

Alternative Fixes

If the main fix doesn't work for some reason — maybe the built-in account is corrupted or you're on a domain-joined machine — try these:

Create a new admin account first. While logged into any account with admin rights (even a disabled one won't help, so use Safe Mode), open Command Prompt as admin:
```
net user TempAdmin Password123 /add
net localgroup Administrators TempAdmin /add
```
Then log out and log into TempAdmin. Now disable or delete the original account. This works because TempAdmin becomes the "last admin" instead.
Use Local Group Policy Editor. On Windows Pro/Enterprise, run gpedit.msc → Computer Configuration → Windows Settings → Security Settings → Local Policies → Security Options. Find Accounts: Administrator account status and set it to Enabled. Same goal — activates the hidden admin.
Safe Mode with Command Prompt. If you've already locked yourself out completely, boot into Recovery Environment (Shift + Restart), then Troubleshoot → Advanced Options → Startup Settings → Restart → press 4 for Safe Mode with Networking. Once in, run the net user administrator /active:yes command from a terminal.

Prevention Tips

The golden rule: always keep at least two admin accounts active. Before you disable or delete any admin account, make sure another one is already active and accessible. This is especially important on standalone workstations or servers that aren't domain-joined. If you're doing bulk user cleanup via PowerShell, add a sanity check before the Disable-LocalUser call — count active admins first:

$admins = Get-LocalGroupMember -Group "Administrators" | Where-Object {$_.ObjectClass -eq "User" -and $_.Enabled -eq $true}
if ($admins.Count -le 1) { Write-Warning "Can't remove last admin!" } else { Disable-LocalUser -Name "TargetAccount" }

Also, never rely on the built-in Administrator as your only fallback — it's disabled by default on fresh installs. Set up a dedicated fallback admin account with a password you store in a password manager. Saves you a trip to Safe Mode.