![系统自动启用访客账户](https://linux22.com/image/712298/%E7%B3%BB%E7%BB%9F%E8%87%AA%E5%8A%A8%E5%90%AF%E7%94%A8%E8%AE%BF%E5%AE%A2%E8%B4%A6%E6%88%B7.png)
我在使用 Windows Server 2008 R2 时遇到了麻烦。我禁用了来宾帐户,并将其设置为不更改密码,以确保安全。
几天后,我注意到来宾帐户已启用。
系统如何自动修改访客账户?
我查看了事件日志。它显示以下内容:
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/20/2017 11:03:04 PM
Event ID: 4738
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: WIN-GQC8F69I8P7
Description:
A user account was changed.
Subject:
Security ID: SYSTEM
Account Name: WIN-GQC8F69I8P7$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Target Account:
Security ID: WIN-GQC8F69I8P7\Guest
Account Name: Guest
Account Domain: WIN-GQC8F69I8P7
Changed Attributes:
SAM Account Name: Guest
Display Name: <value not set>
User Principal Name: -
Home Directory: <value not set>
Home Drive: <value not set>
Script Path: <value not set>
Profile Path: <value not set>
User Workstations: <value not set>
Password Last Set: 20/10/2017 11:03:04 CH
Account Expires: <never>
Primary Group ID: 513
AllowedToDelegateTo: -
Old UAC Value: 0x211
New UAC Value: 0x211
User Account Control: -
User Parameters: -
SID History: -
Logon Hours: All
Additional Information:
Privileges: -
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4738</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" />
<EventRecordID>10641390</EventRecordID>
<Correlation />
<Execution ProcessID="488" ThreadID="5744" />
<Channel>Security</Channel>
<Computer>WIN-GQC8F69I8P7</Computer>
<Security />
</System>
<EventData>
<Data Name="Dummy">-</Data>
<Data Name="TargetUserName">Guest</Data>
<Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data>
<Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
<Data Name="PrivilegeList">-</Data>
<Data Name="SamAccountName">Guest</Data>
<Data Name="DisplayName">%%1793</Data>
<Data Name="UserPrincipalName">-</Data>
<Data Name="HomeDirectory">%%1793</Data>
<Data Name="HomePath">%%1793</Data>
<Data Name="ScriptPath">%%1793</Data>
<Data Name="ProfilePath">%%1793</Data>
<Data Name="UserWorkstations">%%1793</Data>
<Data Name="PasswordLastSet">20/10/2017 11:03:04 CH</Data>
<Data Name="AccountExpires">%%1794</Data>
<Data Name="PrimaryGroupId">513</Data>
<Data Name="AllowedToDelegateTo">-</Data>
<Data Name="OldUacValue">0x211</Data>
<Data Name="NewUacValue">0x211</Data>
<Data Name="UserAccountControl">-</Data>
<Data Name="UserParameters">-</Data>
<Data Name="SidHistory">-</Data>
<Data Name="LogonHours">%%1797</Data>
</EventData>
</Event>
Log Name: Security
Source: Microsoft-Windows-Security-Auditing
Date: 10/20/2017 11:03:04 PM
Event ID: 4724
Task Category: User Account Management
Level: Information
Keywords: Audit Success
User: N/A
Computer: WIN-GQC8F69I8P7
Description:
An attempt was made to reset an account's password.
Subject:
Security ID: SYSTEM
Account Name: WIN-GQC8F69I8P7$
Account Domain: WORKGROUP
Logon ID: 0x3e7
Target Account:
Security ID: WIN-GQC8F69I8P7\Guest
Account Name: Guest
Account Domain: WIN-GQC8F69I8P7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
<EventID>4724</EventID>
<Version>0</Version>
<Level>0</Level>
<Task>13824</Task>
<Opcode>0</Opcode>
<Keywords>0x8020000000000000</Keywords>
<TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" />
<EventRecordID>10641391</EventRecordID>
<Correlation />
<Execution ProcessID="488" ThreadID="5744" />
<Channel>Security</Channel>
<Computer>WIN-GQC8F69I8P7</Computer>
<Security />
</System>
<EventData>
<Data Name="TargetUserName">Guest</Data>
<Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data>
<Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data>
<Data Name="SubjectUserSid">S-1-5-18</Data>
<Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data>
<Data Name="SubjectDomainName">WORKGROUP</Data>
<Data Name="SubjectLogonId">0x3e7</Data>
</EventData>
</Event>
答案1
我会尝试这个,在这个系统上运行 RSOP.msc 然后
计算机配置 > Windows 设置 > 安全设置 > 本地策略 > 安全选项 > 帐户:来宾帐户状态
它应该被禁用。如果它被启用,那么你可以看到哪个 GPO 正在应用该策略
答案2
我已经搜索了几天。我发现这种情况每天晚上都会发生。我猜想这可能是一个任务计划程序,但在任务计划程序中没有找到任何内容。我使用 Sysinternals 工具找到了问题所在。WMI 服务中有一个有害的 VB 脚本。删除它,问题就解决了!