Audit insecure guest logon
This value enables auditing of insecure guest logons by the SMB client.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AuditInsecureGuestLogon
This value enables auditing of insecure guest logons by the SMB client. When the DWORD value is set to 1, Windows records an audit event when an SMB connection is allowed as an unauthenticated guest.
The relevant events are written to the SMB client security log at Microsoft-Windows-SMBClient/Security. Event ID 31022 identifies an allowed insecure guest logon and can include information such as the server name and the user name supplied for the connection attempt.
Notes
Security
The setting provides visibility into guest connections that the client actually permits. These connections do not authenticate the user and do not support SMB signing or SMB encryption. The resulting events can help identify connections that carry an increased risk of malicious-server impersonation, adversary-in-the-middle attacks, or unprotected data transfer.
This value does not enable or permit insecure guest logons. It also does not block them or change access permissions. Whether the SMB client accepts a guest connection is governed by separate settings such as AllowInsecureGuestAuth and by other SMB security requirements.
Notes
Auditing insecure guest logons requires Windows 11, version 24H2 or later, or Windows Server 2025. The Microsoft policy reference additionally identifies Windows 11 build 10.0.26100.3613 or later as supported.
An audit event for an allowed guest logon can occur only when such a connection is otherwise permitted. On systems that reject insecure guest logons, this value does not make guest access available.
Microsoft documentation
Microsoft Learn: Policy CSP – LanmanWorkstation
Microsoft Learn: How to enable insecure guest logons in SMB2 and SMB3