# Configure 'Accounts: Rename guest account'

Necessity: The default 'Guest' account is a well-known security principal on Windows systems. It represents a common target for attackers attempting to gain initial, low-privilege access. Renaming the account is a critical security hardening practice known as security through obscurity. It makes it significantly more difficult for automated tools and malicious actors to identify and exploit this built-in account. Leaving the default name increases the system's attack surface and exposes it to trivial reconnaissance and exploitation attempts. Auditing and Remediation: The audit script verifies the current name of the account associated with the guest account's security identifier (SID S-1-5-32-546), ensuring it is not the default 'Guest'. The remediation script directly renames this account to a new value provided as an argument, thus removing the well-known identifier. Recommended State Rationale: The Basic state ('Guest_Renamed') meets the minimum compliance of changing the name from the default. The Moderate state ('LocalUser_Standard') provides a more generic, non-descriptive name that can align with organizational naming policies while still obscuring the account's original purpose. The Strict state ('Lcl_Acct_x8k4z9') recommends using a randomized and non-guessable string, offering the highest level of obscurity and making the account indistinguishable from other system or service accounts, thereby minimizing its value as a target.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Guest_Renamed']` |
| **Moderate** | `['LocalUser_Standard']` |
| **Strict** | `['Lcl_Acct_x8k4z9']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the name of the local guest account. The script must identify the account using its well-known SID 'S-1-5-32-546' with the Get-LocalUser cmdlet. The script should output only the string value of the account's name.

## Remediation Script Working

PowerShell script that renames the local guest account. The script must accept the new account name as a single, positional command-line argument. It should identify the account by its SID 'S-1-5-32-546' and use Rename-LocalUser to perform the change. The script must return $true on success and $false on failure.

