AD-ACC-004: Guest account enabled¶

high Accounts MITRE ATT&CK T1078.001 Reads: LDAP

The domain's built-in Guest account is enabled, giving a logon that needs no known password to anyone who can reach a domain member.

Why it matters¶

The built-in Guest account (RID 501) has no password by default and is disabled when the domain is created. Domain controllers have no local accounts, so on them this is the Guest: once it is enabled, a network logon as Guest, and on servers that still allow guest fallback a logon with an unknown user name, is accepted with no known password. The session is a member of Everyone and Domain Guests.

That turns an outsider on the network into a domain principal: they can browse shares that grant Everyone access, query the directory where anonymous binds are refused, and start the enumeration that leads to every other finding in this report.

How ad-doctor detects it¶

From the LDAP snapshot: an enabled account whose sAMAccountName is Guest (case does not matter), that is, userAccountControl without ACCOUNTDISABLE (0x2).

The match is by name. A Guest account that was renamed is not recognised by its RID (501), so a renamed and enabled Guest is not reported.

The object is the account name, Guest.

Attributes and probes read

sAMAccountName
userAccountControl

Severity¶

Always high: an enabled domain Guest is a domain identity available to people who hold no credentials at all.

Fix¶

Disable the account. This is what ad-doctor fix generates:
```
Disable-ADAccount Guest -WhatIf
```
Keep it disabled by policy. In a GPO linked to the domain, set Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > Accounts: Guest account status to Disabled.
Find out who enabled it and when (read-only): event 4722 (A user account was enabled) on the domain controllers, and the replication metadata of userAccountControl:
```
$guest = Get-ADUser Guest
Get-ADReplicationAttributeMetadata -Object $guest.DistinguishedName -Server dc01 `
    -Properties userAccountControl
```

Verify¶

ad-doctor scan dc01.corp.example --ldaps -u 'CORP\auditor' --only AD-ACC-004

To accept the risk instead, add an entry to the file passed with --accept (see accepted risks):

[[accept]]
check = "AD-ACC-004"
objects = ["..."]        # optional; without it the whole check is accepted
reason = "..."
expires = 2027-03-31

References¶

Microsoft and vendors

MITRE ATT&CK

T1078.001

Available since 0.1.0.