Securing the Guest account

Thanks to WMI and well known sids we can query a computer for the status of user accounts, lets start with the simple query seen here:

 

 

 

 

 

 

 


From the results of the query we can see that the SID of the built in guest account ends in ‘-501’. so if we run the query

Get-WmiObject -Class Win32_UserAccount|where {$_.sid -like "*-501"}

or better yet (accounting for domain accounts)

Get-WmiObject -Class Win32_UserAccount -Filter  "LocalAccount='True'" |where {$_.sid -like "*-501"}

which shows us some simple info about the user

ensuring that we have the correct user we can use the command ‘Net User‘ to set the password. below is what I use to set a complex 20 character random password for the guest account:

Net User ((Get-WmiObject -Class Win32_UserAccount -Filter  "LocalAccount='True'" |where {$_.sid -like "*-501"}).name) (('abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-_+='.ToCharArray()|Get-Random -Count 20) -join "")