Audit insecure guest logon
This computer-scoped registry value controls server-side auditing of SMB guest logons.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanServer\AuditInsecureGuestLogon
This computer-scoped registry value controls server-side auditing of SMB guest logons. It is a DWORD value. When set to 1, the SMB server records an event whenever an SMB client logs on as the Guest account.
A successful guest logon is recorded as informational event ID 3023 in the Microsoft-Windows-SmbServer/Security log. Its source is Microsoft-Windows-SMBServer, and its task category is InsecureGuestLogon.
The value does not enable guest access or change the permissions assigned to the Guest account. It controls only whether the SMB server records these logons. When the value is 0 or is not configured, this additional event is not logged.
Notes
Security
The resulting events provide visibility into actual SMB guest usage and can support security monitoring and investigation of unexpected guest access. The setting does not block or terminate guest connections, nor does it make them more secure.
Guest logons do not use normal user authentication and do not support standard SMB security features such as SMB signing and SMB encryption. Enabling this registry value does not change those characteristics; it only provides audit data.
Notes
Microsoft maps this value to a computer policy under Network > Lanman Server. The documented default value is 0.
Microsoft documents the associated policy for Windows 11, version 24H2 beginning with build 10.0.26100.3613. Its documentation for insecure guest logons also describes the auditing capability for Windows Server 2025.
Microsoft documentation
Microsoft Learn: LanmanServer Policy CSP
Microsoft Learn: Enable insecure guest logons in SMB2 and SMB3