Skip to main content

Disable Guest Account

Purpose​

Keeps the built-in Windows Guest account disabled on Windows workstations and servers managed by NinjaOne. Turn it on for every client at once, or for one client at a time, with one custom field.

Use it when a security audit or policy requires the Guest account to be disabled.

Associated Content​

ContentTypeFunction
cPVAL Disable Guest AccountCustom FieldTurns the solution on (Enable) or off (Disable) for all clients, a client, a location, or a device.
Disable Guest AccountsAutomationDetects the Guest account and disables it if it is enabled.
Disable Guest Account - ServerCompound ConditionChecks devices daily and runs the automation on Windows server when the Guest account is enabled and the custom field is set to Enable.
Disable Guest Account - WorkstationCompound ConditionChecks devices daily and runs the automation on Windows workstation when the Guest account is enabled and the custom field is set to Enable.

Implementation​

  1. Create the cPVAL Disable Guest Account custom field.
  2. Import the Disable Guest Accounts automation.
  3. Add the below compound conditions to the Windows Workstation Policy [Default] and Windows Server Policy [Default] agent policies.
  4. Set cPVAL Disable Guest Account to Enable:
    • At the system level, to turn it on for every client.
    • At the organization level, to turn it on for one client.

You'll know it worked when the automation's activity details show Disabled Guest account.

FAQ​

Q: Can I leave out a single client or device?
A: Yes. Set cPVAL Disable Guest Account to Disable on that organization or device.

Q: Why are domain controllers skipped?
A: A domain controller's Guest account applies to the whole domain. Manage it with Group Policy instead.

Q: Why did the Guest account turn back on?
A: A Group Policy or Intune policy may be enabling it. Set Accounts: Guest account status to Disabled in that policy.

Changelog​

2026-10-12​

  • Initial version of the document.