Microsoft did not remove guest access by accident or to sell you something. A share that asks for nothing can be impersonated by anyone on the network - and that trick has a body count of real attacks behind it.
It is easy to read the guest block as Microsoft breaking something that worked. It is worth one page of honesty in the other direction: guest access was a genuine hazard, and the block is the fix for attacks that actually happened. A guest session has no password, which sounds like a small convenience. Underneath, it means no identity check in either direction and no way to protect the traffic - and attackers learned to live inside that gap. This is why Windows refuses, in its own words, and why the workarounds deserve the warnings attached to them.
The five things a login buys you - all missing in guest mode. The block is not about the password itself; it is about everything the password makes possible.
Picture your office or home network. Your PC wants the shared folder, so it calls out for the device by name. With guest access, any machine that answers first and says yes, come in, is believed - no credential prompt ever appears to make you suspicious. Microsoft's own warning describes it exactly: a device that accepts guest logons can be tricked into connecting to a malicious server without prompting for credentials, and then be given ransomware or have its data stolen. An attacker who gets onto the network - a compromised smart TV, a visitor's infected laptop, a weak Wi-Fi password - can stand in for your NAS and serve poisoned files to every PC that trusts guest mode.
The second attack is quieter. In a normal login, your credentials can be captured mid-conversation and relayed - forwarded live to another server to impersonate you there. The defence is SMB signing: every packet is stamped with a key only the real login could produce, so tampered or replayed traffic is rejected. A guest session has no key, so it cannot be signed, ever. Microsoft states it flatly: guest logons do not support SMB signing or SMB encryption, even if the client is set to allow them. That is also why Windows 11 24H2, which made signing compulsory, finished guest access off almost completely - the two features are mathematically incompatible.
Twenty-five years of tightening, in one direction, by the people who watch the attack data. That history is worth knowing before switching any of it back off.
None of this makes your home NAS evil. On a small, trusted home network, behind your own router, the realistic attacker is rare - and Microsoft itself documents the switch that re-allows guest logons for exactly the case of a third-party device that cannot do usernames and passwords. Their official recommendation, though, is not the switch: it is to upgrade or replace the device that only supports guest authentication. The risk judgement is yours to make for your network. Make it with the facts above, not with the impression that the block is a bug - and if you do switch it off, switch it off on one PC, at home, knowing exactly which door you reopened.
Watch the video first, then use this page to judge the workaround honestly - what it opens, and what it costs.
▶️ Watch Full VideoBecause it demos well - a share that works from every device with zero setup. Vendors also assume a trusted home network. The feature is not malicious, it is just built for a threat model from twenty years ago, before every home filled with smart devices of unknown quality.
Much safer, yes. A real login lets the session be signed, which defeats tampering and relaying, and lets the share verify who is connecting. It is not invincible - weak passwords and unpatched devices still matter - but it closes the specific holes the guest block exists for.
Your PC, mainly. The policy lives in the Windows SMB client - it governs what your PC will connect to. The NAS would happily keep serving guests to phones and older devices. That is why the same folder can open on your phone and refuse on your new PC.