Security Risk of Disabling forceguest in non-AD Environment

Question

Our application group is looking to deploy a product which requires that we disable forceguest in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa. We are running on a Novell network (I know, I know) and the machines (mostly XP/some 7) are not on a domain. Each machine has two administrative accounts which are password protected, as well as the individual user's account (also an admin) and a general limited account, guest accounts are disabled.

What, if any, are the security risks of disabling forceguest in this environment?

Answer 1

Possible mitigation: Use firewall or IP security policy on workstations to limit connections to 135, 137, 138, 139, 445 from the server running the application.