☰

系统自动启用访客账户

tag-icon • tag-icon windows-server-2008 user-accounts
系统自动启用访客账户

我在使用 Windows Server 2008 R2 时遇到了麻烦。我禁用了来宾帐户，并将其设置为不更改密码，以确保安全。

几天后，我注意到来宾帐户已启用。

系统如何自动修改访客账户？

我查看了事件日志。它显示以下内容：

Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/20/2017 11:03:04 PM
Event ID:      4738
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-GQC8F69I8P7
Description:
A user account was changed.

Subject:
    Security ID:        SYSTEM
    Account Name:       WIN-GQC8F69I8P7$
    Account Domain:     WORKGROUP
    Logon ID:       0x3e7

Target Account:
    Security ID:        WIN-GQC8F69I8P7\Guest
    Account Name:       Guest
    Account Domain:     WIN-GQC8F69I8P7

Changed Attributes:
    SAM Account Name:   Guest
    Display Name:       <value not set>
    User Principal Name:    -
    Home Directory:     <value not set>
    Home Drive:     <value not set>
    Script Path:        <value not set>
    Profile Path:       <value not set>
    User Workstations:  <value not set>
    Password Last Set:  20/10/2017 11:03:04 CH
    Account Expires:        <never>
    Primary Group ID:   513
    AllowedToDelegateTo:    -
    Old UAC Value:      0x211
    New UAC Value:      0x211
    User Account Control:   -
    User Parameters:    -
    SID History:        -
    Logon Hours:        All

Additional Information:
    Privileges:     -
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4738</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" />
    <EventRecordID>10641390</EventRecordID>
    <Correlation />
    <Execution ProcessID="488" ThreadID="5744" />
    <Channel>Security</Channel>
    <Computer>WIN-GQC8F69I8P7</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="Dummy">-</Data>
    <Data Name="TargetUserName">Guest</Data>
    <Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data>
    <Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data>
    <Data Name="SubjectDomainName">WORKGROUP</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
    <Data Name="PrivilegeList">-</Data>
    <Data Name="SamAccountName">Guest</Data>
    <Data Name="DisplayName">%%1793</Data>
    <Data Name="UserPrincipalName">-</Data>
    <Data Name="HomeDirectory">%%1793</Data>
    <Data Name="HomePath">%%1793</Data>
    <Data Name="ScriptPath">%%1793</Data>
    <Data Name="ProfilePath">%%1793</Data>
    <Data Name="UserWorkstations">%%1793</Data>
    <Data Name="PasswordLastSet">20/10/2017 11:03:04 CH</Data>
    <Data Name="AccountExpires">%%1794</Data>
    <Data Name="PrimaryGroupId">513</Data>
    <Data Name="AllowedToDelegateTo">-</Data>
    <Data Name="OldUacValue">0x211</Data>
    <Data Name="NewUacValue">0x211</Data>
    <Data Name="UserAccountControl">-</Data>
    <Data Name="UserParameters">-</Data>
    <Data Name="SidHistory">-</Data>
    <Data Name="LogonHours">%%1797</Data>
  </EventData>
</Event>

    Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          10/20/2017 11:03:04 PM
Event ID:      4724
Task Category: User Account Management
Level:         Information
Keywords:      Audit Success
User:          N/A
Computer:      WIN-GQC8F69I8P7
Description:
An attempt was made to reset an account's password.

Subject:
    Security ID:        SYSTEM
    Account Name:       WIN-GQC8F69I8P7$
    Account Domain:     WORKGROUP
    Logon ID:       0x3e7

Target Account:
    Security ID:        WIN-GQC8F69I8P7\Guest
    Account Name:       Guest
    Account Domain:     WIN-GQC8F69I8P7
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
  <System>
    <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" />
    <EventID>4724</EventID>
    <Version>0</Version>
    <Level>0</Level>
    <Task>13824</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8020000000000000</Keywords>
    <TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" />
    <EventRecordID>10641391</EventRecordID>
    <Correlation />
    <Execution ProcessID="488" ThreadID="5744" />
    <Channel>Security</Channel>
    <Computer>WIN-GQC8F69I8P7</Computer>
    <Security />
  </System>
  <EventData>
    <Data Name="TargetUserName">Guest</Data>
    <Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data>
    <Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data>
    <Data Name="SubjectUserSid">S-1-5-18</Data>
    <Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data>
    <Data Name="SubjectDomainName">WORKGROUP</Data>
    <Data Name="SubjectLogonId">0x3e7</Data>
  </EventData>
</Event>

答案1

我会尝试这个，在这个系统上运行 RSOP.msc 然后

计算机配置 > Windows 设置 > 安全设置 > 本地策略 > 安全选项 > 帐户：来宾帐户状态

它应该被禁用。如果它被启用，那么你可以看到哪个 GPO 正在应用该策略

答案2

我已经搜索了几天。我发现这种情况每天晚上都会发生。我猜想这可能是一个任务计划程序，但在任务计划程序中没有找到任何内容。我使用 Sysinternals 工具找到了问题所在。WMI 服务中有一个有害的 VB 脚本。删除它，问题就解决了！

相关内容