Blog Post

Storage at Microsoft
3 MIN READ

SMB insecure guest auth now off by default in Windows Insider Pro editions

NedPyle's avatar
NedPyle
Icon for Microsoft rankMicrosoft
Jan 13, 2023
Heya folks, Ned here again. Starting in Windows 11 Insider Preview Build 25276, the Pro editions of Windows now disable SMB insecure guest authentication fallbacks by default. We previously turned it...
Updated Jul 02, 2024
Version 6.0
NedPyle's avatar
NedPyle
Icon for Microsoft rankMicrosoft
Jan 25, 2023

Hi ori2sh. Sorry no, we just have rejected event 31017 and an event for when someone has turned on guest auth.

 

Log Name: Microsoft-Windows-SmbClient/Security
Source: Microsoft-Windows-SMBClient
Date: Date/Time
Event ID: 31018
Task Category: None
Level: Warning
Keywords: (128)
User: NETWORK SERVICE
Computer: ServerName.contoso.com
Description: The AllowInsecureGuestAuth registry value is not configured with default settings.

Default registry value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "AllowInsecureGuestAuth"=dword:0

Configured registry value:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters] "AllowInsecureGuestAuth"=dword:1

 

If you have enabled guest auth and want to know when it's actually happening, you'll need to look at network traces from the client. It's not a bad idea to add more auditing here, I'll think about it for a future release.