Solved

Missing something - Guest account keeps disabling itself

Posted on 2009-03-30
8
780 Views
Last Modified: 2012-05-06
I'm opening this question to see if anyone knows a way to determing how the account is becoming disabled. I've checked local group policy, domain group policy, group policies assigned to OU's and I'm not able to find anything that should be disabling the guest account on this machine. It's an XP workstation and I'm sharing printers to the network. Everything works fine when I have the guest account activated so I don't want to disable the guest account. Here's the entry that's added to the event viewer each time the account is disabled.

3/24/2009 7:03:57 PM
User: NT AUTHORITY\SYSTEM
Computer: AIR-RELEASE

Description:
User Account Disabled:
       Target Account Name: Guest
       Target Domain         : AIR-RELEASE
       Target Account ID  : AIR-RELEASE\Guest
       Caller User Name   : AIR-RELEASE$
       Caller Domain         : NAL_A
       Caller Logon ID         : (0x0,0x3E7)

The time that is disabled changes because I'm pretty sure it's related to a cycling event and is affected by the next time I enable the account. I've been logging in each morning and re-enabling the guest account and it works all day long. I've had it disable as early as 7pm range and other nights as late as 2am in the morning. I would think if it was group policy it would happen much more often and much more aggressive.

Ultimately I just need this solved. I'm either looking for a direct way of making sure the guest account doesn't disable or I'm looking for a method to track down the rule that is disabling it so that I can change that rule. I still feel like it's related to group policy but just can't find it.
0
Comment
Question by:CubeRoot
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
8 Comments
 
LVL 27

Expert Comment

by:David-Howard
ID: 24023130
If you're certain that Group Policy isn't affecting the account you might try SFC SCANNOW or a Repair.
SFC SCANNOW takes about fifteen minutes and a Repair about forty minutes.
Both require your OS CD.
SFC SCANNOW
http://www.updatexp.com/scannow-sfc.html
XP Repair:
http://www.michaelstevenstech.com/XPrepairinstall.htm
A Repair is not designed to overwrite data but you should take precautions.
Additionally, while a Repair may correct the issue it will require that you reinstall your most current Service Pack as well as the Hotfixes that accompany it.
0
 
LVL 3

Author Comment

by:CubeRoot
ID: 24023196
I'll give that a shot. I'm not certain that group policy isn't doing the action. I'm just fairly positive that I don't currently have a group policy assigned. I wondering if it's an old setting that's still being reapplied locally to that machine. Not sure if that's even possible.
0
 
LVL 4

Accepted Solution

by:
anuroopkoka2005 earned 500 total points
ID: 24037553
Try to remove the machine from the domain and check the guest account whether the account is still getting disabled....

0
Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

 
LVL 4

Expert Comment

by:anuroopkoka2005
ID: 24037571
Also check the local security policy...
0
 
LVL 3

Author Comment

by:CubeRoot
ID: 24039051
I didn't see anything set in the local security policy. I had the same idea last night about removing the machine from the domain and seeing what that does. I think removing from the domain is a great idea and I'll try that this morning.
0
 
LVL 4

Expert Comment

by:anuroopkoka2005
ID: 24039072
ok sure i will be waiting
0
 
LVL 3

Author Comment

by:CubeRoot
ID: 24101329
I've unjoined the workstation from the domain, re-enabled the guest account, checked local group policy.
It's been two days now and the guest account is still active. Before I removed the workstation from the domain, I couldn't change the local group policy setting for disabling the guest account. It was set to enable but was grayed out. After settting the workstation back to a workgroup, I can now change the local group policy setting. I'm thinking I had some mysterious group policy being applied even though I couldn't find any policies assigned the the workstation or it's OU's.
0
 
LVL 3

Author Closing Comment

by:CubeRoot
ID: 31564385
removing from the domain solved the issue. Thanks for the idea.

0

Featured Post

Don't Cry: How Liquid Web is Ensuring Security

WannaCry is just the start. Read how Liquid Web is protecting itself and its customers against new threats.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Determining the an SCCM package name from the Package ID
This article provides a convenient collection of links to Microsoft provided Security Patches for operating systems that have reached their End of Life support cycle. Included operating systems covered by this article are Windows XP,  Windows Server…
Windows 8 comes with a dramatically different user interface known as Metro. Notably missing from the new interface is a Start button and Start Menu. Many users do not like it, much preferring the interface of earlier versions — Windows 7, Windows X…
Windows 10 is mostly good. However the one thing that annoys me is how many clicks you have to do to dial a VPN connection. You have to go to settings from the start menu, (2 clicks), Network and Internet (1 click), Click VPN (another click) then fi…

724 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question