In our domain, we have the local machine Guest account disabled and renamed through script/GPO.
Our LEM console sends out 10-20 notices each day
TriGeo Alert: "guest account is locked out @ time of day"
or
User Account Modification: "guest account automatically locked out"
Is this normal? I really would just need to know if this account is ever enabled or tried to log in to a machine.