Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If I need to open guest acconut for Windows Server 2008, any security risks? Appreciate if anyone could recommend some readings and also how to resolve any potential security risks.

thanks in advance, George

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Any time you enable something on a machine you introduce added risk. The guest account provides essentially anonymous access to your machine. It has access to local data and apps as a standard user. By default it does not have a password set and the User Cannot Change Password and Password Never Expires options are set for it. Thus, blindly enabling it is typically a bad idea.

You have to define for yourself what a security risk is in your environment. What one person calls a risk another person calls a feature. What is it that you're trying to accomplish?

Edit (in response to your comment):

If you set a password up for the account (there is not one by default) you should keep those options selected. The guest account is meant to be a shared account and if you let users change the password then all it takes is one person to lock everyone out of the account by changing the password. Also, if that password expires then you'll have to redistribute a new password to everyone that you think has it. You're bound to miss someone in a large organization.

share|improve this answer
    
Thanks squillman, do you mean we should set User Cannot Change Password and Password Never Expires or not? And why? I am a bit confused about your reply. –  George2 Aug 24 '10 at 16:25
1  
@George see my edit –  squillman Aug 24 '10 at 19:06
    
Thanks @squillman, if I set password for guest account, then it will become a normal account, correct? Any differences between guest account and normal account in technical perspective? –  George2 Aug 25 '10 at 5:48

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.