Vista Horizons

The Windows Vista security team has posted information on how the built-in administrator account will behave:

In Windows Vista RC1 we will have completed a series of changes to disable the built in administrator account under most circumstances. These changes apply to the default administrator account named Administrator, which is created during setup.
* The built-in administrator account is disabled by default in Windows Vista on new installations.
* If Windows Vista determines during an upgrade from Windows XP that the built-in Administrator is the only active local administrator account, Windows Vista leaves the account enabled and places the account in Admin Approval Mode. The built-in administrator account, by default, cannot log on to the computer in safe mode. Please see the following sections for more information.
* On non-domain joined computers, when there is at least one enabled local administrator account, safe mode will not allow logon with the disabled built-in administrator account. Instead, any local administrator account can be used to logon. If the last local administrator account is inadvertently demoted, disabled or deleted, safe mode will allow the disabled built-in administrator account to logon for disaster recovery.
* On domain joined computers, the disabled built-in administrator account cannot logon in safe mode. By default a user account that is a member of the Domain Admins group can log on to the computer to create a local administrator if none exists. If the domain administrative account had never logged on before, then the computer must be started in Safe Mode with Networking since the credentials will not have been cached. Once the machine is disjoined, it will revert back to the non-domain joined behavior depicted previously.