# Configure 'Accounts: Rename guest account'

The built-in 'Guest' account is a well-known default account on Windows systems. Malicious actors and automated tools frequently target default account names in brute-force or credential-stuffing attacks. Renaming the guest account is a critical security hardening step that practices security through obscurity. By changing the name, you force an attacker to first discover the new name, which complicates and slows down attack attempts, making them easier to detect. The audit script identifies the guest account using its permanent Security Identifier (SID), S-1-5-32-546, and outputs its current display name. The remediation script also uses this SID to reliably locate the account and apply the new name provided as an argument. **Basic:** The state 'RenamedGuest' meets the minimum compliance of changing the default name. **Moderate:** 'LocalVisitor' improves upon basic by removing the easily identifiable 'Guest' keyword entirely, further obfuscating the account's purpose. **Strict:** A complex, non-dictionary name like 'K51b3_Visitor' provides the highest level of obfuscation, making the account extremely difficult to guess and offering no clues as to its function, which is a best practice for hardening publicly accessible or high-value systems.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['RenamedGuest']` |
| **Moderate** | `['LocalVisitor']` |
| **Strict** | `['K51b3_Visitor']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the name of the user account associated with the well-known SID 'S-1-5-32-546' (the Guest account). The script must output only the account name string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that renames the local guest account, which is identified by its static SID 'S-1-5-32-546'. The script must accept the desired new account name as a single, positional command-line argument. It must return `$true` if the renaming operation is successful and `$false` if it fails.

