Windows 11: 23H2 · 1.0 to 25H2 · 1.0

Configure this setting to control the specific user or group who is authorized to decrypt encrypted passwords. Configuring this setting has no effect unless password encryption has been enabled. If this setting is enabled, encrypted passwords will be decryptable by the specified group. If this setting is disabled or not configured, encrypted passwords will be decryptable by the Domain Admins group. This setting must be configured with either a [added: domain-qualified name of a group or user, or a ]SID in string [removed: format ("S-1-5-21-2127521184-1604012920-1887927527-35197") or the name of a group][added: format. Valid examples include: contoso\LAPSAdmins [email protected] S-1-5-21-2127521184-1604012920-1887927527-35197 Do not enclose the user\group name] or [removed: user][added: SID] in [removed: "domain\(group][added: enclosing quotes] or [removed: user)" format. ][added: parentheses. ]The specified user or group must be resolvable by the managed device, otherwise passwords will not be backed up.[added: NOTE: this setting is ignored when Directory Services Repair Mode (DSRM) account passwords are backed up on a domain controller. In that scenario, this setting always defaults to the Domain Admins group of the domain controller's domain.] See https://go.microsoft.com/fwlink/?linkid=2188435 for more information.

This policy setting determines if the SMB client will allow insecure guest logons to an SMB server. If you enable this policy setting or if you do not configure this policy setting, the SMB client will allow insecure guest logons. If you disable this policy setting, the SMB client will reject insecure guest logons. [added: If you enable signing, the SMB client will reject insecure guest logons. ]Insecure guest logons are used by file servers to allow unauthenticated access to shared folders. While uncommon in an enterprise environment, insecure guest logons are frequently used by consumer Network Attached Storage (NAS) appliances acting as file servers. Windows file servers require authentication and do not use insecure guest logons by default. Since insecure guest logons are unauthenticated, important security features such as SMB Signing and SMB Encryption are disabled. As a result, clients that allow insecure guest logons are vulnerable to a variety of man-in-the-middle attacks that can result in data loss, data corruption, and exposure to malware. Additionally, any data written to a file server using an insecure guest logon is potentially accessible to anyone on the network. Microsoft recommends disabling insecure guest logons and configuring file servers to require authenticated access."