Heya folks, Ned here again. Starting in Windows 11 Insider Preview Build 25276, the Pro editions of Windows now disable SMB insecure guest authentication fallbacks by default. We previously turned it...
Updated Jul 02, 2024
Version 6.0
Blog Post
Hi ori2sh. Sorry no, we just have rejected event 31017 and an event for when someone has turned on guest auth.
Log Name: Microsoft-Windows-SmbClient/Security
Source: Microsoft-Windows-SMBClient
Date: Date/Time
Event ID: 31018
Task Category: None
Level: Warning
Keywords: (128)
User: NETWORK SERVICE
Computer: ServerName.contoso.com
Description: The AllowInsecureGuestAuth registry value is not configured with default settings.
Default registry value:[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "AllowInsecureGuestAuth"=dword:0
Configured registry value:[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "AllowInsecureGuestAuth"=dword:1
If you have enabled guest auth and want to know when it's actually happening, you'll need to look at network traces from the client. It's not a bad idea to add more auditing here, I'll think about it for a future release.