{"id":70463,"date":"2005-02-10T15:34:00","date_gmt":"2005-02-10T15:34:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/heyscriptingguy\/2005\/02\/10\/how-can-i-disable-the-guest-account-on-a-computer\/"},"modified":"2005-02-10T15:34:00","modified_gmt":"2005-02-10T15:34:00","slug":"how-can-i-disable-the-guest-account-on-a-computer","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/scripting\/how-can-i-disable-the-guest-account-on-a-computer\/","title":{"rendered":"How Can I Disable the Guest Account on a Computer?"},"content":{"rendered":"

\"Hey, \n

Hey, Scripting Guy! How can I determine whether or not the Guest account is enabled on a computer and, if it is, disable it?

— PR<\/P>\"Spacer\"\"Hey,\"Script<\/A> \n

Hey, PR. At last: a question for which there is a very simple, very straightforward answer. This isn\u2019t to minimize the importance of the task: in general, it\u2019s highly recommended that you disable the Guest account on your computers. It\u2019s just nice to have a question where we don\u2019t have to come up with some crazy workaround.<\/P>\n

Let\u2019s start with determining whether or not the Guest account is enabled on a computer. To do that, we simply need to bind to the Guest account and then check the value of the AccountDisabled<\/B> property. How hard is that? Well, it\u2019s no harder than this:<\/P>

strComputer = “atl-ws-01”\nSet objUser = GetObject(“WinNT:\/\/” & strComputer & “\/Guest”)<\/p>\n
Wscript.Echo “Guest account disabled: ” & objUser.AccountDisabled\n<\/PRE>\n
That\u2019s right, just three lines of code. We assign the name of the computer (atl-ws-01<\/B>) to the variable strComputer, then use ADSI and the WinNT provider to bind to the Guest account on that computer. (Note<\/B>: With the WinNT provider, case is important; don\u2019t type something like winnt<\/I> \u2026 unless, of course, you don\u2019t want a script that actually works). Finally, we echo back the value of the AccountDisabled property. If the Guest account is disabled, then AccountDisabled will be True; if the account is enabled, then AccountDisabled will be False. <\/P>\n
See why we liked this question so much?<\/P>\n
Of course, you might be thinking, \u201cWell, sure, determining whether the Guest account is enabled is easy, but what about disabling<\/I> that account? How hard is that<\/I> going to be?\u201d Well, we have to be honest with you: this is definitely harder. After all, it takes four<\/I> lines of code rather than just three:<\/P>
strComputer = “atl-ws-01”\nSet objUser = GetObject(“WinNT:\/\/” & strComputer & “\/Guest”)<\/p>\n
objUser.AccountDisabled = True\nobjUser.SetInfo\n<\/PRE>\n
As you can see, we bind to the Guest account and set the value of AccountDisabled to True. We then call the SetInfo method to actually write this change to the account, disabling it.<\/P>\n
That\u2019s it. If you want to first check the value of the account and then disable it, you can simply combine the scripts, like so:<\/P>
strComputer = “atl-ws-01”\nSet objUser = GetObject(“WinNT:\/\/” & strComputer & “\/Guest”)<\/p>\n
Wscript.Echo “Guest account disabled: ” & objUser.AccountDisabled<\/p>\n
objUser.AccountDisabled = True\nobjUser.SetInfo\n<\/PRE>\n
Note that no error is generated if you try to disable an account that\u2019s already disabled. Therefore, we simply echo the current account status and then go ahead and disable it. If the account is already disabled, hey, no problem; the script will just gracefully terminate.<\/P><\/p>\n","protected":false},"excerpt":{"rendered":"
Hey, Scripting Guy! How can I determine whether or not the Guest account is enabled on a computer and, if it is, disable it?— PR Hey, PR. At last: a question for which there is a very simple, very straightforward answer. This isn\u2019t to minimize the importance of the task: in general, it\u2019s highly recommended […]<\/p>\n","protected":false},"author":595,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[23,24,3,63,5],"class_list":["post-70463","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-local-accounts-and-windows-nt-4-0-accounts","tag-other-directory-services","tag-scripting-guy","tag-security","tag-vbscript"],"acf":[],"blog_post_summary":"
Hey, Scripting Guy! How can I determine whether or not the Guest account is enabled on a computer and, if it is, disable it?— PR Hey, PR. At last: a question for which there is a very simple, very straightforward answer. This isn\u2019t to minimize the importance of the task: in general, it\u2019s highly recommended […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/70463","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/595"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=70463"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/70463\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=70463"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=70463"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=70463"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}