One office PC asks visitors for a password, another lets everyone straight in. That difference is a single Windows setting — and the “fix” many people apply to it, enabling the Guest account, is one of the worst ideas in small-office networking.
Password prompts on shared folders feel like an obstacle, so the internet's favourite advice is to remove them: turn off password protected sharing, enable Guest, share to Everyone. It works instantly — and it means any device that joins your network, including a visitor's phone or an infected laptop, can open your office files. This page explains what the setting actually does, and how to make logins painless without removing them.
Find it in Control Panel → Network and Sharing Center → Change advanced sharing settings → All Networks. When it is ON, anyone connecting to your shares must authenticate with a username and password that exist on the PC holding the files — and then the share and NTFS permissions decide what that account may do. When it is OFF, Windows allows connections to fall back to the Guest account for shares that permit it. Every permission decision after that is made as "Guest", one identity for the whole network.
Three facts make Guest dangerous in an office. First, Guest has no password — the "login" is a formality any device passes. Second, a share granted to Everyone can include Guest access when password protection is off and Guest is enabled, because the built-in Guest account is enabled precisely to serve anonymous visitors. Third, modern Windows has been closing this door version by version — recent builds disable guest SMB logons by default and may refuse them entirely — so a setup built on Guest tends to break after updates anyway. It is both unsafe and unreliable.
A related behaviour confuses many people: an account with no password can sign in at the keyboard but is refused over the network. That is a deliberate default policy — "Limit local account use of blank passwords to console logon only". Do not disable it to make sharing "easier": a password-less account reachable over the network is an open account. Give every sharing account a real password; it takes a minute and it is the whole foundation of the permission system.
The prompt only feels painful because it repeats. Three legitimate ways to calm it:
Each keeps a named account behind every connection — which is what makes permissions and auditing (the rest of this series) possible at all.
The video shows the complete sharing security setup — accounts, passwords and permissions working together on a real office PC.
▶️ Watch Full VideoThe risk is silent: anyone who gets onto your network — a guest, a customer's laptop, one infected PC — can open Guest-accessible shares without any login. Nothing happening yet means nobody has looked, not that the door is closed.
Usually the saved credential is wrong or belongs to another account: clear it in Credential Manager, disconnect with net use, and reconnect with the exact account that exists on the file PC. Also confirm that account is not using a blank password.
Create them an account — it takes a minute (Settings → Accounts → Other users). A named, password-protected account you can later disable is always better than anonymous access you cannot trace or revoke.