Remove Administrative Shares on a Win2K System

From the March 2002 Edition
of Windows IT Pro
Readers
Reader to Reader
InstantDoc #23782
Windows IT Pro

Windows 2000 has administrative shares (i.e., shares that provide remote access directly to any C drive or logical, physical drive on your system) by default. The administrative shares are those shares that you can use \\computername_or_IPaddress\C$ to access. To manually disable the shares, right-click My Computer, select Map Network Drive, select the drive letter (i.e., C, D, or E), and enter

\\<ComputerName>_or_<Ipaddress><DriveLetter>$

Select Do not share this folder. Unfortunately, when you restart the system the shares will automatically recreate. This feature creates a security risk because anyone who knows the machine's IP address can try to use \\IPaddress\C$ , \\IPaddress\D$, or \\IPaddress\E$ to access the shares.

To remove administrative shares without letting Win2K recreate them every time you reboot the system, you need to edit the registry. Start regedit and go to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters subkey. From the Edit menu, select New, DWORD Value to create the new values AutoShareServer and AutoShareWks; set each value's data to 0 (i.e., false). Next, go to each drive, right-click, and select Sharing. Then, select Do not share this folder.

To test the registry entries you added, restart your system and go to your physical or logical drive's Sharing option. Check whether C$, D$, or E$ appears (they shouldn't). To further ensure that the administrative shares are disabled, try to access \\IPaddress\C$, \\IPaddress\D$, or \\IPaddress\E$.

—Phuoc Trong Ha
phuoc.ha@vectornet.com

End of Article

keep in mind i am a complete idiot because this will disable all local sharing and not just the administrative share. If you wish to try this be absolutely sure you do not want to ever use local sharing.

Phuoc Trong Ha March 17, 2003

The comments posted by Phuoc Trong Ha on March 17, 2003 are incorrect.
The above method will *NOT* disable all local sharing. It will disable the Administrative shares only. All existing or future shares are unaffected by theese registry changes.

In windows XP, in order to remove the shares after the changes have been made to the registry, you need to go to "Windows Explorer" -> "Tools", "Folder Options" [View]
and remove the check in "Use simple sharing (Recommended)"

-that makes it possible to remove the shares.
After the shares are removed, you can change the "Use simple sharing (Recommended)" setting back to enabled.

Angel June 30, 2004

You must log on before posting a comment.

If you don't have a username & password, please register now.