220-1102 Question 489
Single answerDisable guest accountA small office uses standalone Windows 10 Pro PCs at a reception desk. During a security review, you discover that temporary visitors have been able to sign in locally by using the built-in Guest account on one of the systems. The office manager wants the quickest supported fix that prevents anyone from using that account again while keeping the PC otherwise unchanged. Which action should the technician take?
- A
Open Computer Management, go to Local Users and Groups, and disable the Guest account
- B
Rename the Guest account to Visitor so users will not recognize it
- C
Remove the PC from the workgroup so the Guest account cannot be used
- D
Convert the Guest account to a standard user account with a blank password
Show answer and explanation
Correct answer: A
Explanation
The best answer is to disable the built-in Guest account. In Windows administration, disabling unused or insecure accounts is a standard security best practice based on the principle of least privilege. On Windows Pro systems, a technician can use Computer Management > Local Users and Groups > Users to manage local accounts, including disabling Guest. Renaming an account is only obfuscation, not access control. Changing workgroup settings does not affect local account availability. Creating or modifying an account with a blank password is insecure and does not meet the stated requirement. Microsoft security guidance and common administrative best practices support disabling unnecessary built-in accounts to reduce unauthorized local access.
- A. Correct.
Correct. On Windows Pro editions, the built-in Guest account can be managed through Computer Management under Local Users and Groups. Disabling the account is the direct, supported way to prevent any future sign-ins with that account while leaving the rest of the system configuration intact. This matches the requirement for a quick security fix with minimal change.
- B. Incorrect.
Incorrect. Renaming the account does not disable it or prevent logon. It only changes the displayed account name. An enabled account can still be used if someone discovers the new name or if the account is referenced by its security identifier internally. This is a common misconception because obscuring an account name is not the same as removing access.
- C. Incorrect.
Incorrect. Workgroup membership is unrelated to whether a local built-in account can sign in at the machine. The Guest account is a local account issue, not a network membership issue. Removing the system from a workgroup would not reliably stop local Guest logons and would create unnecessary configuration changes.
- D. Incorrect.
Incorrect. Converting the Guest account to another account type and leaving it with a blank password would weaken security rather than improve it. A standard user account can still sign in if enabled, and blank passwords are not an appropriate mitigation. The goal is to prevent use of the built-in Guest account, which is accomplished by disabling it.