Solved

Deleting Guest account in XP pro

Posted on 2004-09-21
25
335 Views
Last Modified: 2012-06-27
As title.

Even administrator can't do that, so what good is admin right ?
back to the topic, disable it will not satisfy me, Because I know how to
reset it to working account, I need it to be deleted.


Any comments or question will be appreciated.
0
Comment
Question by:hafa
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 9
  • 6
  • 3
  • +6
25 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
ID: 12119885
Hello hafa =)

hmmmmmmmm not a Common and easy thing to do,,,, lots of registry modifications are required.... so if u want to try it, try it on ur own risk and ALWAYS BACKUP UR REGISTRY BEFORE CHANGING IT !!

Hide/delete the Guest Account (WXP)
http://www.winguides.com/forums/showflat.php?Cat=&Board=brdNewTweaks&Number=70039&page=7&view=collapsed&sb=5&part=

!! GOOD LUCK !!
0
 
LVL 4

Expert Comment

by:beem4n
ID: 12119951
Hey,

you should also remember, that deleting Guest account may cause problems in windows xp,
because some of proggies and network tools use it.
0
 
LVL 1

Author Comment

by:hafa
ID: 12119978
Thanks, sheharyaarsaahil, but it does not work on sp2 (like everything else)
i was hoping to find a less painful way to do this, little tweak on registry is fine..

Beem4n, caution noted. it shouldnt be any problem on my machine, mine is just a env. for my vm
0
Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

 
LVL 4

Expert Comment

by:beem4n
ID: 12120157
Hi again,

you should do the next:

1. backup your registry
2. remove the following in registry:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest

3. reboot

just tested on my winxp pro sp2 english
0
 
LVL 5

Expert Comment

by:XSINUX
ID: 12120186
You need to Boot to Safe mode and Log as Administrator.

1. Click "Change an account" in the "Pick a task" list box.
2. Click the account that you want to change.
3. Select the item that you would like to change:

Click "Delete the account" to delete the user account from the computer. When you delete the account, you are given the
option to save the user's files on the computer.

If this does not worK, disable the GuesT account and then try Deleting it.

Note: You can not delete the account for a user that is currently logged on to the computer.
0
 
LVL 4

Accepted Solution

by:
beem4n earned 400 total points
ID: 12120209
XSinux: you can't delete guest account via usual methods, since it is built-in.

The only way to remove is registry tweaking.
0
 
LVL 1

Author Comment

by:hafa
ID: 12120316
thanks for your promptly response, beem4n.
did not succeed, but getting there. on user account home screen, Guest is dissappear, admin has big rectangular box all the way across. i was happy for a moment, then after reboot i saw it Guest on welcome screen with admin. quickswitch enabled. guest was on the list, AND with a password (how the hell did it gain a password??) i guess that part of registry on SAM is messed up. then went into computer management, local users, guest properties, it gives me this message- "internal error with the account ERROR E0019", try set password, hit the wall too. ah. that was something, so now it exists but does not exist...hmm, seen that before.. Right, linux partitioin
0
 
LVL 4

Expert Comment

by:beem4n
ID: 12120351
If you wouldnt find any new solutions,
i suggest you to rename guest account in local security and then disable it.
Also you can set it a very long password, more than 15 chars. So it wouldnt be available in LanMan format, so if
you guest account will be enabled it will be impossible for an attacker to bruteforce it in small time.
0
 
LVL 1

Author Comment

by:hafa
ID: 12120461
beem4n. just exchange this info with ya.
Password(s), user name(s), whatsoever.
because whatever you set, whatever long it is, will be cracked eventually
countless method out in the open, even i know a few, could pass that gate
slave drive, password overwrite, ms  password recovery, and tons of other bootdisks
my reason why want to rid of guest, is to set some limitation, so at least one less hole in my system
anyway, theres a known way to see Guest account gone, bug i have to reinstall from scratch, set account in wme, kill guest account, upgrade to w2k, then xp pro. that will take a solid 2 hours.
and i would rather tweak with registry now.. :)

your help is greatly appreciated
0
 
LVL 4

Expert Comment

by:beem4n
ID: 12120722
Re,

try the following:

1. backup your registry
2. remove the following in registry:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Guests
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000222
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1957994488-1364589140-839522115\000001F5

S-1-5-21-1957994488-1364589140-839522115 - this string may differ, important is last: \000001F5

3. reboot

Think, this should work ;)
0
 
LVL 1

Author Comment

by:hafa
ID: 12120770
looked into khey folder, under sam there were nothing.
http://www.geocities.com/sony22lcd/untitled.JPG
did add stuff to it earlier, and now end up nothing.
0
 
LVL 3

Expert Comment

by:Julian_C
ID: 12120821
I don't suppose that using gpedit.msc and just renaming the guest account (under Computer Configuration\Security Settings\Local Policies\Security Options\Accounts: Rename guest account) would help at all. It could then be justa disabled account with any name you want? You still can't delete it easily but at least nobody knows what it's called.

Cheers
Julian
0
 
LVL 4

Expert Comment

by:beem4n
ID: 12120899
Hafa,

dont know why your SAM table is empty,

i give up ;)
0
 
LVL 1

Author Comment

by:hafa
ID: 12120934
try me best too. luck will knock my door soon.
0
 
LVL 1

Expert Comment

by:hgkeh
ID: 12121018
Try this utility from NTSecurity:

http://ntsecurity.nu/toolbox/delguest/

But i would not recommend deleting guest account because it might bring side-effects to the system. Read the FAQ for more information.

http://www.jsiinc.com/SUBJ/tip4800/rh4894.htm

0
 
LVL 1

Author Comment

by:hafa
ID: 12121107
delgust.exe works on NT5.0 only. xp are 5.1
0
 
LVL 5

Expert Comment

by:XSINUX
ID: 12121155
Try this....

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5

Double-click "V" then make your way to "Offset 0178" and replace the number "47" with "42".
Then go and have a look at Control Panel\User Accounts

All this does is hide the Guest Account from view. It is not possible to Delete the Guest account. Thanks

Cheers
Sinu
0
 
LVL 1

Author Comment

by:hafa
ID: 12121253
Everything under SAM is gone, thats why I end up with 1 account viewable in users accounts menu. but somehow it shows up on quickswitch welcome screen with a godknowswhat password. worst comes to worst, i'll install from scratch

point value raised to 400
0
 
LVL 5

Expert Comment

by:XSINUX
ID: 12121288
to get around this Delete the default registry and copy snapshot files.

 
Boot to Recovery Console.

At the Recovery Console command prompt, type the following lines, and then press the <Enter> key after you type each line:

del c:\windows\system32\config\sam

del c:\windows\system32\config\security

del c:\windows\system32\config\software

del c:\windows\system32\config\default

del c:\windows\system32\config\system




copy c:\windows\tmp\_registry_machine_software c:\windows\system32\config\software

copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\system

copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam

copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\security

copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\default

Type exit and press the <Enter> key to quit the Recovery Console.
The computer will restart.
 
0
 
LVL 4

Expert Comment

by:wooying
ID: 12134574
Just dsiable it if it bother you that much.  Why go through all this headache
0
 
LVL 1

Author Comment

by:hafa
ID: 12136864
because i can enable your guest account from 500 different ports.
0
 

Expert Comment

by:a7a1986
ID: 12141157
Hi Hafa,

OK. The best way to delete the guest account is:

1. In Control Panel (Start>Control Panel), goto Administrative Tools.

2. Double Click on Computer Management.

3. In the System Tools list, open the sub list Local Users & Groups, click on Users.

4. You'll see the Guest account in the other list. Right click on it and select Delete. Click on Yes if appears.

-a7a1986-
0
 
LVL 1

Author Comment

by:hafa
ID: 13313330
Not solved. but i hate to leave a hanging case, so there goes your points.
0
 

Expert Comment

by:remedina
ID: 13313896
run regedit and go to HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
change the 47 to 42 to hide account.
To delete account all together you will need to delete the Data Value from the Binary Name "V" then copy and paste this reg file info into Notepad, save it onto your Desktop as NoGuest.reg and double-click it:-
--------------------Copy and Paste within the lines---------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5]
"V"=hex:00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,0a,00,00,00,00,00,00,\
00,bc,00,00,00,00,00,00,00,00,00,00,00,bc,00,00,00,70,00,00,00,00,00,00,00,\
2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,\
01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,\
00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,\
00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,\
08,00,00,00,01,00,00,00,34,01,00,00,04,00,00,00,00,00,00,00,38,01,00,00,04,\
00,00,00,00,00,00,00,3c,01,00,00,04,00,00,00,00,00,00,00,40,01,00,00,04,00,\
00,00,00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,\
00,02,00,30,00,02,00,00,00,02,c0,14,00,44,00,05,01,01,01,00,00,00,00,00,01,\
00,00,00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,\
00,4c,00,03,00,00,00,00,00,14,00,1b,03,02,00,01,01,00,00,00,00,00,01,00,00,\
00,00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,\
00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,\
01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01
-------------------End Copy and Paste---------------------------------
Once this is copied go back to the registry :
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest
and delete the "Guest" Key.

**BE SURE TO BACK-UP REGISTRY PRIOR TO THE ABOVE** TRY AT YOUR OWN RISK
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

#Citrix #POC #XenDesktop #vCenter #VMware #ESX
I use more than 1 computer in my office for various reasons. Multiple keyboards and mice take up more than just extra space, they make working a little more complicated. Using one mouse and keyboard for all of my computers makes life easier. This co…
This is used to tweak the memory usage for your computer, it is used for servers more so than workstations but just be careful editing registry settings as it may cause irreversible results. I hold no responsibility for anything you do to the regist…
Hi friends,  in this video  I'll show you how new windows 10 user can learn the using of windows 10. Thank you.

691 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question