Guest Account Is a Member of the Domain Users Group (312136)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Datacenter Server SP2
This article was previously published under Q312136

SYMPTOMS

In a Windows 2000 domain where anonymous access has been turned on for the Guest account, the Guest account has access to resources that Domain Users are granted permissions to. The Guest account is a member of the Domain Users group.

CAUSE

Because the Guest account is re-created during installation and inherits the Domain Users group membership directly from the User class, any file permissions or share permissions for the Domain Users will now allow the Guest account access also. This is different from previous versions of Microsoft Windows, in which the Guest account is not a member of the Domain Users group.

RESOLUTION

To resolve this problem, remove the Guest account from the Domains Users group.

REFERENCES

For additional information about a related issue with Microsoft Windows NT 3.5, click the article number below to view the article in the Microsoft Knowledge Base:

118569 Domain Guests Group Not Created On Upgrade

Modification Type:MajorLast Reviewed:12/18/2003
Keywords:kbnofix kbprb KB312136
©2003 Microsoft Corporation. All rights reserved.