Apparently FileVault may also affect this, which we also use. Anybody know of a way to have EFI and FileVault enabled at the same time, and allow guest access? We want guest access incase the unit is stolen so a user can join a network and we can track it.
Yeah, FileVault is the bigger issue here I think. If the goal is to have a somewhat "standard" user account that guests can log into, then FileVault needs to be disabled. With FV on, the expected behavior is the Mac reboots to an EFI/Recovery-level type environment that only runs Safari.
So you can have these configurations:
Guest on/FV off/EFI on = standard user account experience in Guest user
Guest on/FV on/EFI off = reboots to Safari-only environment
Guest on/FV on/EFI on = reboots to EFI password, then user is passed to Safari-only environment
Thanks @sshort, much appreciated.
Yup, it's because the guest is not FV enabled so you get a prompt to authenticate