Re: File sharing

From: Torgeir Bakken \(MVP\) (Torgeir.Bakken-spam_at_hydro.com)
Date: 06/05/05 

Date: Sun, 05 Jun 2005 19:00:17 +0200

Paul Froehle wrote:

> The windows firewall is on File and print sharing is on. However if
> I turn off the firewall, I still can't get in. the ME machine will
> not accept my XP password even though the accounts are the same.
> The xp account is an administrator account.
>
> The only thing I can figure is somewhere there is another switch
> that forbids XP to accept any outside user or password.
> (snip)
Hi,

It could be a ForceGuest issue...

Note that for Windows XP in a workgroup setting, default all connections
coming from "the network" will be authenticated as the Guest User.

Note that for WinXP Home you cannot disable the ForceGuest behavior
(only in WinXP Pro).

A direct registry edit is possible to change this setting:

HOWTO: Validate User Credentials on Microsoft Operating Systems

http://support.microsoft.com/default.aspx?scid=KB;EN-US;180548

<quote>
On Windows XP, the ForceGuest registry value is set to 1 by default in
the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

On a Windows XP computer that is a member of a workgroup:

If ForceGuest is enabled (set to 1), SSPI will always try to log on
using the Guest account.

If the Guest account is enabled, an SSPI logon will succeed as Guest
for any user credentials.

If the Guest account is disabled, an SSPI logon will fail even for
valid credentials.

If ForceGuest is disabled (set to 0), SSPI will log on as the specified
user.

</quote>

Note that "Folder Options/Use simple file sharing" and GPEDIT.MSC and
the "Network access: Sharing and security model for local accounts"
policy setting is just another way of changing the ForceGuest value.

More about ForceGuest here as well:

How to Set Security in Windows XP Professional That Is Installed
in a Workgroup
http://support.microsoft.com/default.aspx?scid=kb;en-us;290403

SMTP Authentication Configuration on Windows XP Professional Edition
http://support.microsoft.com/default.aspx?scid=kb;en-us;304707 

-- 
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

Relevant Pages

  • Re: File sharing
    ... >> The windows firewall is on File and print sharing is on. ... > It could be a ForceGuest issue... ... Validate User Credentials on Microsoft Operating Systems ... > If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Microsoft Baseline Security Analyzer, multiple computer scanni
    ... Also, for Windows XP computers, you need to handle the ForceGuest ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: WMI Query during sysprep mini-setup (XP SP1)
    ... > meaning all remote connections connect under the guest account, ... Windows XP in a workgroup setting all connections coming from ... Note that for WinXP Home you cannot disable the ForceGuest behavior ...
    (microsoft.public.windowsxp.wmi)
  • Re: Networking between Win XP Sp2 pro with Win2K Pro
    ... > Win2k Pro OS system. ... Most likely a ForceGuest issue. ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Cannot access XP sharing even settings are right
    ... Or it could be a ForceGuest issue as well. ... Note that for Windows XP in a workgroup setting, ... If the Guest account is enabled, an SSPI logon will succeed as Guest ...
    (microsoft.public.windowsxp.security_admin)