windows default hidden shares

Non-Profit Techie

im sure i could google this, but im lazy! anyway, anyone know how to turn off these shares so they dont turn back on after reboot?

Webmaster

http://support.microsoft.com/default.aspx?scid=kb;en-us;842715

Non-Profit Techie

so what are you trying to tell me? LOL. guess i wont be needing to do that then huh?

Webmaster

Just pointing out the consequences so you know what you are getting into. That, but the article also implies the answer to your question:

If you set the AutoShareWks registry DWORD value to 0 (in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters) the default shares won't be (re-)created at startup. Depending on whether any of the problems in the article I pointed out apply to your Windows XP machine you can 'safely' remove them.

NPA24

Quick question, why would you want to disable these shares?? If you are looking at it in a security perspective you can always permission them out to certain groups or individuals. Just my opinion.

Webmaster

'A' valid reason can be to minimize the number of 'access points'. Even though you can secure it tighly it is another way in for a potential attacker. Exploits in the past allowed connections to IPC$ and indirectly to vital system files while evading authentication. If new ways to abuse the hidden aministrative shares are discovered you won't be vulnerable to it. I guess it comes down to one of the objectives in the Security+ exam: Non-essential services, i.o.w. if you don't need, and want things to be as secure as possible, don't run it. As I pointed out previously, they do have a valid purpose, so removing them 'can' result in unavoidable problems.

Plantwiz

Learned something new today!