Re: Networking between Win XP Sp2 Pro with Win 2k Pro - Continue

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 12/17/04 

Date: Fri, 17 Dec 2004 21:55:12 +0100

Gary wrote:

> I posted recently, that I am having problems connecting between the computer
> running win os XP sp2 Pro with one running win os 2k pro. I could get access
> from the xp sp2 pro machine to the win 2k pro machine. I can see the XP sp2
> Pro machine fromt the win 2k pro machine.
> (snip)
> I also turn the window firewall off.
>
> I still get the following error:
>
> D9z7h461 (which is the name of the XP Sp2 Pro Machine) is not accessible.
> Logon failure! User account restriction.
Hi

Note that for Windows XP in a workgroup setting, all connections coming
from "the network" will default be authenticated as the Guest User.

Note that for WinXP Home you cannot disable the ForceGuest behavior
(only in WinXP Pro).

A direct registry edit is also possible to change this setting:

HOWTO: Validate User Credentials on Microsoft Operating Systems

http://support.microsoft.com/default.aspx?scid=KB;EN-US;180548

<quote>
On Windows XP, the ForceGuest registry value is set to 1 by default in
the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

On a Windows XP computer that is a member of a workgroup:

If ForceGuest is enabled (set to 1), SSPI will always try to log on
using the Guest account.

If the Guest account is enabled, an SSPI logon will succeed as Guest
for any user credentials.

If the Guest account is disabled, an SSPI logon will fail even for
valid credentials.

If ForceGuest is disabled (set to 0), SSPI will log on as the specified
user.

</quote>

More about ForceGuest here as well:

How to Set Security in Windows XP Professional That Is Installed
in a Workgroup
http://support.microsoft.com/default.aspx?scid=kb;en-us;290403

SMTP Authentication Configuration on Windows XP Professional Edition
http://support.microsoft.com/default.aspx?scid=kb;en-us;304707 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: File sharing
    ... >> The windows firewall is on File and print sharing is on. ... > It could be a ForceGuest issue... ... Validate User Credentials on Microsoft Operating Systems ... > If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Microsoft Baseline Security Analyzer, multiple computer scanni
    ... Also, for Windows XP computers, you need to handle the ForceGuest ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: WMI Query during sysprep mini-setup (XP SP1)
    ... > meaning all remote connections connect under the guest account, ... Windows XP in a workgroup setting all connections coming from ... Note that for WinXP Home you cannot disable the ForceGuest behavior ...
    (microsoft.public.windowsxp.wmi)
  • Re: File sharing
    ... > The xp account is an administrator account. ... It could be a ForceGuest issue... ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Networking between Win XP Sp2 pro with Win2K Pro
    ... > Win2k Pro OS system. ... Most likely a ForceGuest issue. ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)