# Ensure 'Accounts: Guest account status' is set to 'Disabled'

The 'Guest' account is a built-in account with limited privileges, intended for temporary or one-time users to access a computer. Its existence provides a well-known potential entry point for attackers. If enabled, it allows unauthenticated network users to log on and access any resources accessible to the Guest group, significantly increasing the system's attack surface. The primary risk is unauthorized access to network shares and system information. The audit script checks the active status of the 'Guest' account using native Windows management interfaces. The remediation script directly modifies this status by either enabling or disabling the account as specified. The recommended state across all security levels (Basic, Moderate, and Strict) is 'Disabled'. There is no security justification for enabling the Guest account in a production environment. Maintaining it as disabled is a foundational security best practice recommended by numerous security frameworks, such as the CIS Benchmarks, as it eliminates a common and easily exploitable vulnerability.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the status of the built-in 'Guest' user account. The script must return the string 'Disabled' if the account is disabled, or 'Enabled' if it is active. The output must consist solely of the status string, with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional string argument: 'Enabled' or 'Disabled'. The script must configure the built-in 'Guest' user account's status to match the provided argument. The script must return the boolean value $true upon successful completion or $false if the operation fails.

