From 42339375437c21830bcbd0d9fa1afa4533e4cedb Mon Sep 17 00:00:00 2001
From: Harrison Ravazzolo <38767391+harrisonravazzolo@users.noreply.github.com>
Date: Wed, 29 Jan 2025 09:27:42 -0800
Subject: [PATCH] Add CSP to disable guest account, add to canary team (#25862)

Confirmed on my vm that this profile deploys successfully and that the
key in gpedit is updated to Disabled.

<img width="516" alt="csp-1"
src="https://github.com/user-attachments/assets/20c407f1-e696-4cc9-90c9-2ce3d896e751"
/>
<img width="353" alt="csp-2"
src="https://github.com/user-attachments/assets/53218049-595b-4b16-97d0-ac434d883c47"
/>

---------

Co-authored-by: Allen Houchins <allenhouchins@mac.com>
---
 .../configuration-profiles/disable-guest-account.xml  | 11 +++++++++++
 it-and-security/teams/workstations-canary.yml         |  1 +
 2 files changed, 12 insertions(+)
 create mode 100644 it-and-security/lib/windows/configuration-profiles/disable-guest-account.xml

diff --git a/it-and-security/lib/windows/configuration-profiles/disable-guest-account.xml b/it-and-security/lib/windows/configuration-profiles/disable-guest-account.xml
new file mode 100644
index 000000000000..b969e73fdadb
--- /dev/null
+++ b/it-and-security/lib/windows/configuration-profiles/disable-guest-account.xml
@@ -0,0 +1,11 @@
+<Replace> 
+  <Item>
+    <Meta>
+      <Format xmlns="syncml:metinf">int</Format>
+    </Meta>
+    <Target>
+      <LocURI>./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/Accounts_EnableGuestAccountStatus</LocURI>
+    </Target>
+      <Data>0</Data>
+  </Item>
+</Replace>
diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml
index 805a7a8fafc0..0f0661a198d8 100644
--- a/it-and-security/teams/workstations-canary.yml
+++ b/it-and-security/teams/workstations-canary.yml
@@ -106,6 +106,7 @@ controls:
       - path: ../lib/windows/configuration-profiles/advanced-logging-powershell.xml
       - path: ../lib/windows/configuration-profiles/autoset-time-date.xml
       - path: ../lib/windows/configuration-profiles/disable-onedrive.xml
+      - path: ../lib/windows/configuration-profiles/disable-guest-account.xml
   windows_updates:
     deadline_days: 7
     grace_period_days: 2