Microsoft Windows 11

The built-in guest account must be renamed

STIG ID: WN11-SO-000025 |   SRG: SRG-OS-000480-GPOS-00227 |   Severity: Medium |   CCI: CCI-000366 |   Vulnerability ID: V-253436

Description

The built-in guest account is a well-known user account on all Windows systems and, as initially installed, does not require a password. This can allow access to system resources by unauthorized users. Renaming this account to an unidentified name improves the protection of this account and the system.

Check

C-56889r829390_chk

Verify the effective setting in Local Group Policy Editor.Run "gpedit.msc".Navigate to Local Computer Policy >> Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options.If the value for "Accounts: Rename guest account" is set to "Guest", this is a finding.

Fix

F-56839r829391_fix

Configure the policy value for Computer Configuration >> Windows Settings >> Security Settings >> Local Policies >> Security Options >> "Accounts: Rename guest account" to a name other than "Guest".