When performing certain automated tasks in which no user or process is logged in, the system will use the default name "guest", which is similar to the behavior seen when "system" is shown updating a record in the platform. The user accounts that have been updated by "guest" are accounts where users had failed login attempts or were locked out of the system. 

You can confirm which fields the "guest" account has updated by reviewing either the sys_audit table of the history list from the record.

1. On a user record where the Updated by field shows "guest"
2. Right click in the header of the form History > List. This will show you the history list for your record, and show you in the Audit History section the fields that have been updated. 
3. You will see the "Locked Out" field could have been updated by guest, or the "Failed Login Attempts" counter, as well as the "Password Reset" box and the "Locked Out Reason" field.

 You can also find this information directly from the sys_audit table.

1. Copy the sys_id of an impacted user record and then navigate to the Audit table (sys_audit)
2. Show matching where Table Name is sys_user
3. Populate the Document Key field with the user record sys_id number
4. Look where User is guest

This behavior is working as expected in our platform. 

For user records that have been created by "guest" please see -- KB0683896 - User Records are being Created by the "guest" User