Solved

Deleting Guest account in XP pro

Posted on 2004-09-21
25
314 Views
Last Modified: 2012-06-27
As title.

Even administrator can't do that, so what good is admin right ?
back to the topic, disable it will not satisfy me, Because I know how to
reset it to working account, I need it to be deleted.


Any comments or question will be appreciated.
0
Comment
Question by:hafa
  • 9
  • 6
  • 3
  • +6
25 Comments
 
LVL 65

Expert Comment

by:SheharyaarSaahil
Comment Utility
Hello hafa =)

hmmmmmmmm not a Common and easy thing to do,,,, lots of registry modifications are required.... so if u want to try it, try it on ur own risk and ALWAYS BACKUP UR REGISTRY BEFORE CHANGING IT !!

Hide/delete the Guest Account (WXP)
http://www.winguides.com/forums/showflat.php?Cat=&Board=brdNewTweaks&Number=70039&page=7&view=collapsed&sb=5&part=

!! GOOD LUCK !!
0
 
LVL 4

Expert Comment

by:beem4n
Comment Utility
Hey,

you should also remember, that deleting Guest account may cause problems in windows xp,
because some of proggies and network tools use it.
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
Thanks, sheharyaarsaahil, but it does not work on sp2 (like everything else)
i was hoping to find a less painful way to do this, little tweak on registry is fine..

Beem4n, caution noted. it shouldnt be any problem on my machine, mine is just a env. for my vm
0
 
LVL 4

Expert Comment

by:beem4n
Comment Utility
Hi again,

you should do the next:

1. backup your registry
2. remove the following in registry:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest

3. reboot

just tested on my winxp pro sp2 english
0
 
LVL 5

Expert Comment

by:XSINUX
Comment Utility
You need to Boot to Safe mode and Log as Administrator.

1. Click "Change an account" in the "Pick a task" list box.
2. Click the account that you want to change.
3. Select the item that you would like to change:

Click "Delete the account" to delete the user account from the computer. When you delete the account, you are given the
option to save the user's files on the computer.

If this does not worK, disable the GuesT account and then try Deleting it.

Note: You can not delete the account for a user that is currently logged on to the computer.
0
 
LVL 4

Accepted Solution

by:
beem4n earned 400 total points
Comment Utility
XSinux: you can't delete guest account via usual methods, since it is built-in.

The only way to remove is registry tweaking.
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
thanks for your promptly response, beem4n.
did not succeed, but getting there. on user account home screen, Guest is dissappear, admin has big rectangular box all the way across. i was happy for a moment, then after reboot i saw it Guest on welcome screen with admin. quickswitch enabled. guest was on the list, AND with a password (how the hell did it gain a password??) i guess that part of registry on SAM is messed up. then went into computer management, local users, guest properties, it gives me this message- "internal error with the account ERROR E0019", try set password, hit the wall too. ah. that was something, so now it exists but does not exist...hmm, seen that before.. Right, linux partitioin
0
 
LVL 4

Expert Comment

by:beem4n
Comment Utility
If you wouldnt find any new solutions,
i suggest you to rename guest account in local security and then disable it.
Also you can set it a very long password, more than 15 chars. So it wouldnt be available in LanMan format, so if
you guest account will be enabled it will be impossible for an attacker to bruteforce it in small time.
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
beem4n. just exchange this info with ya.
Password(s), user name(s), whatsoever.
because whatever you set, whatever long it is, will be cracked eventually
countless method out in the open, even i know a few, could pass that gate
slave drive, password overwrite, ms  password recovery, and tons of other bootdisks
my reason why want to rid of guest, is to set some limitation, so at least one less hole in my system
anyway, theres a known way to see Guest account gone, bug i have to reinstall from scratch, set account in wme, kill guest account, upgrade to w2k, then xp pro. that will take a solid 2 hours.
and i would rather tweak with registry now.. :)

your help is greatly appreciated
0
 
LVL 4

Expert Comment

by:beem4n
Comment Utility
Re,

try the following:

1. backup your registry
2. remove the following in registry:

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Names\Guests
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\00000222
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Builtin\Aliases\Members\S-1-5-21-1957994488-1364589140-839522115\000001F5

S-1-5-21-1957994488-1364589140-839522115 - this string may differ, important is last: \000001F5

3. reboot

Think, this should work ;)
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
looked into khey folder, under sam there were nothing.
http://www.geocities.com/sony22lcd/untitled.JPG
did add stuff to it earlier, and now end up nothing.
0
 
LVL 3

Expert Comment

by:Julian_C
Comment Utility
I don't suppose that using gpedit.msc and just renaming the guest account (under Computer Configuration\Security Settings\Local Policies\Security Options\Accounts: Rename guest account) would help at all. It could then be justa disabled account with any name you want? You still can't delete it easily but at least nobody knows what it's called.

Cheers
Julian
0
What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

 
LVL 4

Expert Comment

by:beem4n
Comment Utility
Hafa,

dont know why your SAM table is empty,

i give up ;)
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
try me best too. luck will knock my door soon.
0
 
LVL 1

Expert Comment

by:hgkeh
Comment Utility
Try this utility from NTSecurity:

http://ntsecurity.nu/toolbox/delguest/

But i would not recommend deleting guest account because it might bring side-effects to the system. Read the FAQ for more information.

http://www.jsiinc.com/SUBJ/tip4800/rh4894.htm

0
 
LVL 1

Author Comment

by:hafa
Comment Utility
delgust.exe works on NT5.0 only. xp are 5.1
0
 
LVL 5

Expert Comment

by:XSINUX
Comment Utility
Try this....

HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5

Double-click "V" then make your way to "Offset 0178" and replace the number "47" with "42".
Then go and have a look at Control Panel\User Accounts

All this does is hide the Guest Account from view. It is not possible to Delete the Guest account. Thanks

Cheers
Sinu
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
Everything under SAM is gone, thats why I end up with 1 account viewable in users accounts menu. but somehow it shows up on quickswitch welcome screen with a godknowswhat password. worst comes to worst, i'll install from scratch

point value raised to 400
0
 
LVL 5

Expert Comment

by:XSINUX
Comment Utility
to get around this Delete the default registry and copy snapshot files.

 
Boot to Recovery Console.

At the Recovery Console command prompt, type the following lines, and then press the <Enter> key after you type each line:

del c:\windows\system32\config\sam

del c:\windows\system32\config\security

del c:\windows\system32\config\software

del c:\windows\system32\config\default

del c:\windows\system32\config\system




copy c:\windows\tmp\_registry_machine_software c:\windows\system32\config\software

copy c:\windows\tmp\_registry_machine_system c:\windows\system32\config\system

copy c:\windows\tmp\_registry_machine_sam c:\windows\system32\config\sam

copy c:\windows\tmp\_registry_machine_security c:\windows\system32\config\security

copy c:\windows\tmp\_registry_user_.default c:\windows\system32\config\default

Type exit and press the <Enter> key to quit the Recovery Console.
The computer will restart.
 
0
 

Expert Comment

by:remedina
Comment Utility
0
 
LVL 4

Expert Comment

by:wooying
Comment Utility
Just dsiable it if it bother you that much.  Why go through all this headache
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
because i can enable your guest account from 500 different ports.
0
 

Expert Comment

by:a7a1986
Comment Utility
Hi Hafa,

OK. The best way to delete the guest account is:

1. In Control Panel (Start>Control Panel), goto Administrative Tools.

2. Double Click on Computer Management.

3. In the System Tools list, open the sub list Local Users & Groups, click on Users.

4. You'll see the Guest account in the other list. Right click on it and select Delete. Click on Yes if appears.

-a7a1986-
0
 
LVL 1

Author Comment

by:hafa
Comment Utility
Not solved. but i hate to leave a hanging case, so there goes your points.
0
 

Expert Comment

by:remedina
Comment Utility
run regedit and go to HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5
change the 47 to 42 to hide account.
To delete account all together you will need to delete the Data Value from the Binary Name "V" then copy and paste this reg file info into Notepad, save it onto your Desktop as NoGuest.reg and double-click it:-
--------------------Copy and Paste within the lines---------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\000001F5]
"V"=hex:00,00,00,00,b0,00,00,00,02,00,01,00,b0,00,00,00,0a,00,00,00,00,00,00,\
00,bc,00,00,00,00,00,00,00,00,00,00,00,bc,00,00,00,70,00,00,00,00,00,00,00,\
2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,\
01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,\
00,00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,\
00,00,00,00,00,00,00,00,00,2c,01,00,00,00,00,00,00,00,00,00,00,2c,01,00,00,\
08,00,00,00,01,00,00,00,34,01,00,00,04,00,00,00,00,00,00,00,38,01,00,00,04,\
00,00,00,00,00,00,00,3c,01,00,00,04,00,00,00,00,00,00,00,40,01,00,00,04,00,\
00,00,00,00,00,00,01,00,14,80,90,00,00,00,a0,00,00,00,14,00,00,00,44,00,00,\
00,02,00,30,00,02,00,00,00,02,c0,14,00,44,00,05,01,01,01,00,00,00,00,00,01,\
00,00,00,00,02,c0,14,00,ff,ff,1f,00,01,01,00,00,00,00,00,05,07,00,00,00,02,\
00,4c,00,03,00,00,00,00,00,14,00,1b,03,02,00,01,01,00,00,00,00,00,01,00,00,\
00,00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,\
00,00,00,18,00,ff,07,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,24,02,00,00,\
01,02,00,00,00,00,00,05,20,00,00,00,20,02,00,00,01
-------------------End Copy and Paste---------------------------------
Once this is copied go back to the registry :
HKEY_LOCAL_MACHINE\SAM\SAM\Domains\Account\Users\Names\Guest
and delete the "Guest" Key.

**BE SURE TO BACK-UP REGISTRY PRIOR TO THE ABOVE** TRY AT YOUR OWN RISK
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Introduction Often we come across situations wherein our batch files would be needing to reboot Windows for a variety of reasons. A few of them would be like: (1) Setup files have been updated whose changes can take effect only after a reboot …
In this article we will discuss all things related to StageFright bug, the most vulnerable bug of android devices.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now