Enable insecure guest logons
This `REG_DWORD` value controls whether the Windows SMB client accepts unauthenticated guest logons offered by an SMB server.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\Software\Policies\Microsoft\Windows\LanmanWorkstation\AllowInsecureGuestAuth
This REG_DWORD value controls whether the Windows SMB client accepts unauthenticated guest logons offered by an SMB server. A value of 1 permits these logons; a value of 0 rejects them.
Permitting guest logons can provide access to devices that expose file shares only through guest access, including some older NAS appliances. The value governs outbound SMB client connections. It does not enable the local Guest account or allow inbound guest access to shares hosted by the computer.
The remote server's share and file permissions still determine which resources and operations are available. This value does not grant unrestricted access to all data on the server.
Notes
Security
An insecure guest session does not authenticate the user to the server through a regular user account, nor does it establish the server's identity through normal user authentication. A spoofed or malicious SMB server can therefore accept a guest connection without causing a credential error or displaying a credential prompt.
Guest logons do not support SMB signing or SMB encryption. Traffic in the guest session consequently lacks the integrity and confidentiality protections supplied by those features. This exposes the connection to risks including adversary-in-the-middle attacks, tampered files, disclosure of data in transit, and malware delivered through a share.
Data written to a file server through a guest session may also be available to other network users when the server exposes its guest shares broadly.
Possible side effects
Allowing insecure guest logons does not by itself guarantee connectivity to a guest-only server. The SMB client rejects the guest session if SMB signing or SMB encryption is required.
Notes
An absent value should not be treated universally as equivalent to either 0 or 1.
Microsoft documentation
Microsoft Learn: Enable insecure guest logons in SMB2 and SMB3
Microsoft Learn: LanmanWorkstation Policy CSP