You have just installed a Windows 2003 server. What action should you take regarding the default administrator and guest accounts for securing a computer?

Disabling both the built-in Administrator and Guest accounts and creating new accounts with non-default names is a core Windows Server hardening best practice. Attackers commonly begin attacks by targeting these well-known account names; removing them eliminates a predictable entry point. The required administrative and guest functionality is preserved by the newly named accounts without exposing the default identifiers.

Retaining the Guest account leaves an unauthenticated or minimally authenticated access point that can be exploited for unauthorized access and system enumeration.

Leaving default accounts unchanged violates the principle of attack surface reduction, as both account names are well-known targets for automated credential attacks.

Keeping the Administrator account active retains a high-privilege account with a universally known name, making it a prime target for brute force and pass-the-hash attacks.