This article is written to take you through the process of implementing the Intune Guest Account Status Policy. We’ll make use of Intune’s Settings Catalog to enforce this policy, emphasizing a practical, hands-on approach to make you understand the Guest Account Status Policy in action with Intune.
Guest Account Status Policy configuration establishes the status of the Guest account, indicating whether it is enabled or disabled. By default, it is set to Disabled.
It’s important to note that if the Guest account is disabled and the security parameter “Network Access: Sharing and Security Model for local accounts” is configured to Guest Only, certain network logons, such as those executed by the Microsoft Network Server (SMB Service), will encounter failures.
The default Guest account permits network users without authentication to log in as Guest without requiring a password. Such unauthorized users may gain access to resources available to the Guest account across the network.
This functionality implies that any network shares with permissions granting access to the Guest account, the Guests group, or the Everyone group become accessible over the network. This situation poses a risk of data exposure or corruption.
- Create Intune Policy to Block Microsoft Accounts
- Best Way to Enforce Password History Policy using Intune
Guest Account Status Policy with the help of Intune
To implement Guest Account Status Policy with the help of Intune, follow the steps stated below:
- Sign in to the Intune Admin Center portal https://intune.microsoft.com/.
- Select Devices > Windows > Configuration profiles > Create a profile.
In Create Profile, I select Windows 10 and later in Platform, and select Profile Type as Settings catalog. Click on the Create button.
|Windows 10 and later
On the Basics tab pane, I provide a name for the policy as “Guest Account Status Policy.”
- Optionally, if you want, you can enter a policy description and proceed by selecting “Next“.
Now in Configuration Settings,
- Click Add Settings to browse or search the catalog for the settings I want to configure.
- In the Settings Picker windows
- I searched for the keyword Guest
- I found the category Local Policies Security Options and selected this
When I select that option as stated above, I see the sub-category Accounts Enable Guest Account Status. After selecting that, click the cross mark at the right-hand corner, as shown below.
Here I choose disable for Accounts Enable Guest Account Status in Local Policies Security Options.
Using Scope tags, you can assign a tag to filter the profile to specific IT groups. One can add scope tags (if required). More details on Intune Scope Tags Implementation Guide.
- Click Next to continue.
Now in Assignments, in Included Groups, you need to click on Add Groups, and choose Select Groups to include one or more groups to deploy the Guest Account Status Policy.
- Click Next to continue.
In the Review + Create tab, I review settings. After clicking on Create, changes are saved, and the profile is assigned.
After successfully creating the “Guest Account Status Policy,” a notification will appear in the top right-hand corner confirming the action. You can also verify the policy’s existence by navigating to the Configuration Profiles list, where it will be prominently displayed.
Your groups will receive your profile settings when the devices check in with the Intune service. The Policy applies to the device.
Intune Report for Guest Account Status Policy
To track the assignment of the policy, you need to select the relevant policy which is ‘Guest Account Status Policy’ from the Configuration Profiles list. Then, you can review the device and user check-in status to determine whether the policy has been successfully applied.
- If you require more detailed information, you can click on “View Report” to access additional insights.
Intune MDM Event Log related to Guest Account Status Policy
To verify the successful implementation of String or integer policies for Guest Account Status Policy on Windows 10 or 11 devices through Intune, you can leverage event IDs 813 and 814.
These event IDs provide valuable insights into the application status of the Guest Account Status Policy as well as the specific value assigned to the policy on those devices. In the case of this particular policy, the value is an Integer and is linked to the event ID 813.
By analyzing these event IDs, you can gain a clear understanding of the policy’s application status and the corresponding value associated with it on the devices in question.
To confirm this, you can check the Event log path – Applications and Services Logs – Microsoft – Windows – Devicemanagement-Enterprise-Diagnostics-Provider – Admin.
MDM PolicyManager: Set policy string, Policy: (