我遇到了Windows Server 2008 R2的麻烦。 我禁用了guest帐户，为了安全起见，请将其设置为不更改密码。
几天后，我注意到guest帐户已启用。
系统如何自动修改来宾帐户？
我回顾了事件日志。 它显示了以下内容：
Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/20/2017 11:03:04 PM Event ID: 4738 Task Category: User Account Management Level: Information Keywords: Audit Success User: N/A Computer: WIN-GQC8F69I8P7 Description: A user account was changed. Subject: Security ID: SYSTEM Account Name: WIN-GQC8F69I8P7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: WIN-GQC8F69I8P7\Guest Account Name: Guest Account Domain: WIN-GQC8F69I8P7 Changed Attributes: SAM Account Name: Guest Display Name: <value not set> User Principal Name: - Home Directory: <value not set> Home Drive: <value not set> Script Path: <value not set> Profile Path: <value not set> User Workstations: <value not set> Password Last Set: 20/10/2017 11:03:04 CH Account Expires: <never> Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: - SID History: - Logon Hours: All Additional Information: Privileges: - Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4738</EventID> <Version>0</Version> <Level>0</Level> <Task>13824</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" /> <EventRecordID>10641390</EventRecordID> <Correlation /> <Execution ProcessID="488" ThreadID="5744" /> <Channel>Security</Channel> <Computer>WIN-GQC8F69I8P7</Computer> <Security /> </System> <EventData> <Data Name="Dummy">-</Data> <Data Name="TargetUserName">Guest</Data> <Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data> <Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data> <Data Name="SubjectUserSid">S-1-5-18</Data> <Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data> <Data Name="SubjectDomainName">WORKGROUP</Data> <Data Name="SubjectLogonId">0x3e7</Data> <Data Name="PrivilegeList">-</Data> <Data Name="SamAccountName">Guest</Data> <Data Name="DisplayName">%%1793</Data> <Data Name="UserPrincipalName">-</Data> <Data Name="HomeDirectory">%%1793</Data> <Data Name="HomePath">%%1793</Data> <Data Name="ScriptPath">%%1793</Data> <Data Name="ProfilePath">%%1793</Data> <Data Name="UserWorkstations">%%1793</Data> <Data Name="PasswordLastSet">20/10/2017 11:03:04 CH</Data> <Data Name="AccountExpires">%%1794</Data> <Data Name="PrimaryGroupId">513</Data> <Data Name="AllowedToDelegateTo">-</Data> <Data Name="OldUacValue">0x211</Data> <Data Name="NewUacValue">0x211</Data> <Data Name="UserAccountControl">-</Data> <Data Name="UserParameters">-</Data> <Data Name="SidHistory">-</Data> <Data Name="LogonHours">%%1797</Data> </EventData> </Event> Log Name: Security Source: Microsoft-Windows-Security-Auditing Date: 10/20/2017 11:03:04 PM Event ID: 4724 Task Category: User Account Management Level: Information Keywords: Audit Success User: N/A Computer: WIN-GQC8F69I8P7 Description: An attempt was made to reset an account's password. Subject: Security ID: SYSTEM Account Name: WIN-GQC8F69I8P7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: WIN-GQC8F69I8P7\Guest Account Name: Guest Account Domain: WIN-GQC8F69I8P7 Event Xml: <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event"> <System> <Provider Name="Microsoft-Windows-Security-Auditing" Guid="{54849625-5478-4994-A5BA-3E3B0328C30D}" /> <EventID>4724</EventID> <Version>0</Version> <Level>0</Level> <Task>13824</Task> <Opcode>0</Opcode> <Keywords>0x8020000000000000</Keywords> <TimeCreated SystemTime="2017-10-20T16:03:04.790779000Z" /> <EventRecordID>10641391</EventRecordID> <Correlation /> <Execution ProcessID="488" ThreadID="5744" /> <Channel>Security</Channel> <Computer>WIN-GQC8F69I8P7</Computer> <Security /> </System> <EventData> <Data Name="TargetUserName">Guest</Data> <Data Name="TargetDomainName">WIN-GQC8F69I8P7</Data> <Data Name="TargetSid">S-1-5-21-1551155493-3377209804-688432216-501</Data> <Data Name="SubjectUserSid">S-1-5-18</Data> <Data Name="SubjectUserName">WIN-GQC8F69I8P7$</Data> <Data Name="SubjectDomainName">WORKGROUP</Data> <Data Name="SubjectLogonId">0x3e7</Data> </EventData> </Event> 我会试试这个，然后在这个系统上运行RSOP.msc
计算机configuration> Windows设置>安全设置>本地策略>安全选项>帐户：来宾帐户状态
它应该被禁用。 如果已启用，则可以看到GPO正在应用该策略
我一直在寻找几天。 我意识到它每天晚上都在同一时间发生。 我猜想这可能是一个任务计划程序，然后在任务计划程序中找不到任何东西。 我使用Sysinternals工具，发现问题。 WMI服务中存在一个VB脚本。 删除它，问题就解决了！