- Guest account access to a remote server.
SMB2 and SMB3 has the following behavior in these versions of Windows:
- Windows 10 Enterprise and Windows 10 Education no longer allow a user to connect to a remote share by using guest credentials by default, even if the remote server requests guest credentials.
A malicious computer that impersonates a legitimate file server could allow users to connect as guests without their knowledge. We recommend that you don't change this default setting. If a remote device is configured to use guest credentials, an administrator should disable guest access to that remote device and configure correct authentication and authorization.
Windows and Windows Server have not enabled guest access or allowed remote users to connect as guest or anonymous users since Windows 2000. Only third-party remote devices might require guest access by default. Microsoft-provided operating systems do not.
Note: If modifying Active Directory domain-based group policy, use Group Policy Management (gpmc.msc).
For monitoring and inventory purposes: this group policy is setting the following DWORD registry value to 1 (insecure guest auth enabled) or 0 (insecure guest auth disabled):
To set the value without using group policy, set the following following DWORD registry value to 1 (insecure guest auth enabled) or 0 (insecure guest auth disabled):
Note: As usual, the value setting in group policy will override the value setting in the non-group policy registry value.
On Windows 10 1709, Windows 10 1803, Windows 10 1903, Windows 10 1909, and Windows Server 2019, guest authentication is disabled if AllowInsecureGuestAuth exists with a value of 0 in
On Windows 10 2004, Windows 10 20H2, and Windows 10 21H1 Enterprise and Education editions with KB5003173 installed, guest authentication is disabled if AllowInsecureGuestAuth does not exist or if it exists with a value of 0 in
Note: By enabling insecure guest logons, this setting reduces the security of Windows clients.