# Ensure 'Accounts: Guest account status' is set to 'Disabled'

The built-in Guest account provides a way for users to access a computer or domain without a personal account. It has a well-known Security Identifier (SID), making it a common target for attackers seeking to gain an initial foothold on a system. If enabled, it could be exploited to access network resources, enumerate system information, or serve as a launchpad for further privilege escalation attacks. Disabling the Guest account is a critical security best practice that significantly reduces the system's attack surface. The audit script verifies the current enabled/disabled state of the Guest account using PowerShell's Get-LocalUser cmdlet. The remediation script uses Enable-LocalUser or Disable-LocalUser to configure the account status as required. For this specific setting, there is no gradation of security; the only secure state is 'Disabled'. Therefore, the Basic, Moderate, and Strict recommendations are identical, aligning with security benchmarks like CIS and DISA STIGs which mandate that this account must be disabled to prevent unauthorized access.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the status of the built-in 'Guest' account. The script must return the string 'Enabled' if the account is active or 'Disabled' if it is not. The output must contain only one of these two strings, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be either 'Enabled' or 'Disabled'. The script will set the status of the built-in 'Guest' account to match the provided argument. The script must return the boolean value $true upon successful completion or $false if it fails.

