Safely managing the built-in local administrator

Short answer Find the built-in local administrator by RID 500, inspect it and enable only when required.

When to use it

When the account is disabled or its localized name is unknown.

$Admin=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'}
$Admin | Select-Object Name,Enabled,LastLogon,PasswordExpires

Note

RID 500 identifies the built-in administrator.

$Admin=Get-LocalUser | Where-Object {$_.SID.Value -match '-500$'}
Enable-LocalUser -Name $Admin.Name

Note

Never place the password in plain text.

Use Windows LAPS instead of a permanent shared local-administrator password.