Microsoft KB Archive/312136

= Guest Account Is a Member of the Domain Users Group =

Article ID: 312136

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Service Pack 2
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 2

-



This article was previously published under Q312136



SYMPTOMS
In a Windows 2000 domain where anonymous access has been turned on for the Guest account, the Guest account has access to resources that Domain Users are granted permissions to. The Guest account is a member of the Domain Users group.



CAUSE
Because the Guest account is re-created during installation and inherits the Domain Users group membership directly from the User class, any file permissions or share permissions for the Domain Users will now allow the Guest account access also. This is different from previous versions of Microsoft Windows, in which the Guest account is not a member of the Domain Users group.



RESOLUTION
To resolve this problem, remove the Guest account from the Domains Users group.

