Windows

Create a secure Guest Account in Windows 7

Find the guest account setting

In certain environments and situations, you may want to grant guest-user access to a workstation running Microsoft Windows 7. Best practices dictate that such access be as secure as possible. Here are several steps you can, and should, take before giving access to a guest user in Windows 7.

Note: This tip applies to Windows 7 Professional and Ultimate only. It does not apply to Windows 7 Home Premium.

Secure Guest Account
The first step is to enable guest accounts, which is disabled by default. Type "computer" into the Start Menu search box as shown and then click on the "Computer Management" item in the results.

This gallery is also available as a TechRepublic blog post and download. Image created by Mark Kaelin for TechRepublic. The gallery was originally published in August 2010.

About

Mark Kaelin is a CBS Interactive Senior Editor for TechRepublic. He is the host for the Microsoft Windows and Office blog, the Google in the Enterprise blog, the Five Apps blog and the Big Data Analytics blog.

6 comments
mfdiwan
mfdiwan

how to stop a guest to view acess my full E drive and some folders in windows 7

diammeter
diammeter

It would be useful for a back up area if it stays undeleted as mine used to in Vista - it was my part of the hard drive which got deleted when I tried system restore and the public area was untouched.

Gis Bun
Gis Bun

First rule of thumb is not to use the Guest account. So create a separate account, add it to the Guest security group [and remove it from the default Users group].

Chug
Chug

This article seems to be geared toward using the Guest account to log in locally on the PC. I have the opposite situation. In just my own home network, I want to be able to use Guest to allow access to some shares on one of my PC's (basically so I don't have to manage user accounts for every PC). Any advice on that? Here's my initial thoughts. Password - can I put a password on Guest and still be able to use it to access shares from other computers? I obviously would NOT set the "Deny access to this computer from the network" policy for Guest, but I think I WOULD set the all of the "Deny logon..." policies for Guest, and probably remove Guest from the "Log on locally" policy. I would still definitely make sure Guest is not in the policy for "Shut down the system". Other than those (and the obvious "you shouldn't let Guest have network access to your PC at all") am I missing anything else, or disagree with any of the policies I mention above that I would set? The goal is to allow Guest to be used for network access to specific shares from other computers, but NOT to allow Guest to be used to actually log in either locally or remotely to the PC with.

diammeter
diammeter

RE: Shut Down the System (Create a secure Guest Account in Windows 7) It would be useful for a back up area if it stays undeleted as mine used to in Vista - it was my part of the hard drive which got deleted when I tried system restore and the public area was untouched. by diammeter | 08/29/10

TWBurger
TWBurger

Agreed. No use making it easy to guess an account name.