MediumOS hardeningBLWK-WIN-008

The Windows Guest account is enabled

What this means

The built-in Guest account is switched on. Anyone who can reach this computer, at the keyboard or over the network, can sign in without a password of their own and reach shared folders and printers.

How to fix it

In an administrator PowerShell run: Get-LocalUser | Where-Object { $_.SID -like *-501 } | Disable-LocalUser. Or open Computer Management → Local Users and Groups → Users → Guest and tick Account is disabled.

Check it yourself

Run a scan and look for BLWK-WIN-008 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads windows_security and reports this check when:

guest_enabled_known == true and guest_enabled == true

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

References

• MITRE ATT&CK T1078.001

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001