Administrative shares

Every NT based Microsoft Windows system (NT/W2K/XP/2003) automatically creates a network share of every hard drive. These shares will allow anyone with the administrator password access to the root of every hard drive on a system. Unless you are in an enterprise environment you will probably not want these enabled. A recently released vunerability in SP2 gives even more concern. Read here: http://www.pcwelt.de/know-how/extras/103039/

=Share Names=

These shares are the drive letter name with a $ at the end.

For example:

//NetworkComputerName/(Drive letter)$

In the real world it would look like this:

//mycomp/c$

That would be the share of the C drive. Substitute the drive letter and it will work with any drive on the machine.

There is also a share of the Windows folder.

//mycomp/ADMIN$

=How to disable=

You can delete the shares but they will just be renewed at the next startup. The easiest way correct this is through Regedit. If the entry is not there it has to be created.

==Servers==

NT 4.0/W2K/Windows Server 2003

Hive: HKEY_LOCAL_MACHINE Key: SYSTEMCurrentControlSetServicesLanManServerParameters Name: AutoShareServer Data Type: REG_DWORD Value: 0

==Regular Workstation==

NT 4.0 Workstation/W2K Pro/XP

Hive: HKEY_LOCAL_MACHINE Key: SYSTEMCurrentControlSetServicesLanManServerParameters Name: AutoShareWks Data Type: REG_DWORD Value: 0