Chapter 9 — Guest and external access
Lesson map
Lesson 09 published. Map, example, EX041.
flowchart TD
N0["Learning outcomes"]
N1["9.1 Guest risks"]
N2["Lab — Guest expiry"]
N3["9.2 Lab results"]
N4["9.3 Acting on results"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX041"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["9.1 Guest risks"]
N2["Lab — Guest expiry"]
N3["9.2 Lab results"]
N4["9.3 Acting on results"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX041"]
[Learning outcomes]
|
v
[9.1 Guest risks]
|
v
[Lab — Guest expiry]
|
v
[9.2 Lab results]
|
v
[9.3 Acting on results]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX041]
Learning outcomes
You will (1) review guest accounts; (2) apply sponsorship and expiry; (3) run a guest expiry lab.
9.1 Guest risks
External auditors and clients access shared folders through guest accounts. Guests are easily forgotten: an engagement ends, but the guest keeps access to confidential folders. Daniel's policy requires each guest to have a sponsor, an employee responsible for them, and an expiry date no more than six months ahead, renewable by the sponsor. Guests must use multi-factor authentication. Sponsorship and expiry make external access temporary by default rather than permanent by accident. Daniel explains the policy to sponsors in a short note so they understand their duty and when renewals are due.
Lab — Guest expiry
"""Guest account expiry report on synthetic data (read-only)."""
from datetime import date
TODAY = date(2026, 6, 30)
# guest, sponsor, expiry (None = no expiry set), last sign-in
GUESTS = [
("auditor1@ext", "p.wade", date(2026, 7, 31), date(2026, 6, 28)),
("client-a@ext", "j.ross", None, date(2025, 10, 3)),
("client-b@ext", "k.ng", date(2026, 5, 31), date(2026, 5, 20)),
("consult@ext", None, None, date(2026, 6, 12)),
("client-c@ext", "j.ross", date(2026, 9, 30), date(2026, 6, 25)),
]
def main():
for g, sponsor, exp, last in GUESTS:
issues = []
if sponsor is None:
issues.append("no sponsor")
if exp is None:
issues.append("no expiry")
elif exp < TODAY:
issues.append(f"expired {exp} but still enabled")
if (TODAY - last).days > 90:
issues.append(f"inactive {(TODAY - last).days} days")
if issues:
print(f"{g}: {'; '.join(issues)}")
print(f"{len(GUESTS)} guests checked")
if __name__ == "__main__":
main()
Run with python3 lab_guests.py. Verified output:
client-a@ext: no expiry; inactive 270 days
client-b@ext: expired 2026-05-31 but still enabled
consult@ext: no sponsor; no expiry
5 guests checked
9.2 Lab results
Daniel's standard-library script reads a synthetic list of five guests with sponsor, expiry and last sign-in, and reports problems. client-a has no expiry and has been inactive for 270 days; client-b expired on 31 May but is still enabled; consult has neither sponsor nor expiry. auditor1 and client-c are fine. The script only reads synthetic data and prints a list. Daniel notes that client-b shows the expiry date was recorded but not enforced. He checks the output by hand against the synthetic list, then records the run date.
9.3 Acting on results
With sponsors, Daniel disables client-a and client-b after confirming their engagements ended. For consult, nobody claims sponsorship at first; the managing partner identifies the engagement and becomes sponsor, setting a three-month expiry. Daniel then configures the directory's guest access reviews so expiry is enforced automatically, with sponsors reminded two weeks ahead. Fixing the process, not just the three accounts, prevents the same findings at the next review. Sponsors confirm each decision by email, which Daniel files with the evidence. The next guest report, a month later, shows no problems, and he notes the result for the partners.
Worked example
The guest lab finds 3 of 5 guests with problems; two are disabled, one gains a sponsor, and automatic expiry enforcement is configured.
Synthetic case. Guests and data are synthetic.
Errors and limits
Recording guest expiry dates without enforcing them leaves expired guests active.
Exercises
- EX041 — Guest policy. What must each guest have? Rubric: 3 = sponsor and expiry within six months;; 2 = sponsor;; 1 = vague;; 0 = none.
- EX042 — client-b issue. What was wrong with client-b? Rubric: 3 = expired but still enabled;; 2 = not enforced;; 1 = vague;; 0 = none.
- EX043 — consult issue. What was wrong with consult? Rubric: 3 = no sponsor and no expiry;; 2 = both;; 1 = inactive;; 0 = none.
- EX044 — Sponsor found. Who became consult's sponsor? Rubric: 3 = the managing partner;; 2 = partner;; 1 = Daniel;; 0 = none.
- EX045 — Process fix. What process fix was made? Rubric: 3 = automatic expiry with sponsor reminders;; 2 = enforcement;; 1 = vague;; 0 = none.
Synthesis
Sponsored, expiring guest access with automatic enforcement keeps external access temporary.
Continue studying — chapter 09 of 12
← Chapter 08 (draft) · Course chapter index · Chapter 10 (draft) →