Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm on a work network, and I had some files I wanted to give to a colleague. I set up a shared folder and directed him to my computer name to open the shared folder. Then I remembered from a long time ago seeing C$, and tried I entering this:

\\COMPUTER-NAME\C$

Now, he got access to my computer. He could do everything on my file system, including adding files to the startup folder.

Why is this open for everybody by default? Why isn't this a feature one can enable on demand? It seems a good feature for the IT department, but after doing some research I found that the permission was in LOCAL-COMPUTER-NAME\Administrators (not in a separate group for the IT department). Does Microsoft just suppose most people doesn't know about this and leave it open by default? Or is it probably our IT department who set this up by mistake?

share|improve this question
    
But this should be only available for windows xp, doesn't it? Also, this: superuser.com/questions/59708/shared-folders-and-c –  kiBytes Jan 24 at 14:43
    
I'm on Windows 7 –  Friend of Kim Jan 24 at 14:51
    
But where are you trying this connection from? –  kiBytes Jan 24 at 14:52
    
I'm on the work Wifi logged on my own account (one of many other Domain accounts). –  Friend of Kim Jan 24 at 15:19
    
Yes but, how the scenario looks like? From where are you trying to access the C$ folder? Which are the privileges of each users? –  kiBytes Jan 24 at 15:25

2 Answers 2

up vote 2 down vote accepted

The C$ shares (and related $ADMIN,$IPC) are only available to members of the Administrators group.

These usually aren't a problem unless

  1. The wrong people are made "Domain Administrators" in Active Directory
  2. Two people are logged into their machine as "Administrator" with the same password.

According to the comments, you both log in as administrator, and because he was able to access your machine, the passwords must be the same... this is by design.

If you don't like this behaviour, then change your administrator password on both machines, and don't tell each other what that password is. Additionally, you should create a separate account (non administrator) with a different username/password for all future work.

It is possible to disable the C$ share, but I wouldn't recommend it in a managed environment (with a decent network admin) since many administrative tools require this share to be present. You can disable this in GPO or the registry.

share|improve this answer
    
Add to 1. "...and Domain Administrators are left in the local Administrators group on your systems." –  Iszi Jan 24 at 15:38
    
Thank you for a good answer! I just have to clear some things up. I'm a hobby programmer and know quite a lot about computers in general. But I have very little experience with Windows domains because it's all just a hobby. –  Friend of Kim Jan 24 at 16:48
    
This is all happening on my work laptop which we are allowed to use for personal use outside of work hours. I'm going to try to understand what is happening here. We all have domain accounts we use to log in (DOMAIN\username). We all have administrator permissions on our own computers. This means that if I log into a collegues computer with MY username and password, it works, and I get administrator access to the computer. –  Friend of Kim Jan 24 at 16:51
    
Is it so that there are groups set up on each computer that has got a set of permissions, and Users and Administrators are shipped with Windows by default. Then each user can be added to the groups? All are added to Users and some to Administrators? –  Friend of Kim Jan 24 at 16:52
    
I found an administrator account on the computer, and when asking the IT department what it was for, they said it was to have access to my computer if I forgot my password. (They know the password, and it's probably the same on all computers.) –  Friend of Kim Jan 24 at 16:53

Not all of them are, they're disabled by default (although they still exist) from Vista onwards.

If you have the $ADMIN,$IPC, $C etc. shares open on your machine, and it's XP - then it's a default setting from Microsoft. If you have them enabled for Win 7, Vista etc. then check whether they're actually accessible without credentials.

As to why, I think it was basically poor foresight, and laziness mixed together to create a really significant security bug, thankfully now mostly defunct.

share|improve this answer
    
So you're saying it's not enabled by default on Windows 7? I'm a local administrator, only on my own computer. –  Friend of Kim Jan 24 at 15:15
2  
This is inaccurate. The given shares are enabled by default on all systems, at least up to Windows 7, when they are added to a domain. –  Iszi Jan 24 at 15:39
    
Ah well, in that case I turn out to have been misinformed. –  Owen Jan 24 at 16:30
    
@Iszi I tried doing this on my home computer, and it asked for credentials. However, I've been setting up the permissions manually and carefully because I have a web server running on the network, so I don't know if this means that "C$-sharing" is disabled by default on Windows 7. Do you say that it is disabled on Windows 7 in a regular workgroup, but enabled on a domain by default? –  Friend of Kim Jan 24 at 16:45
    
@FriendofKim That's what I'm saying - a normal, fresh-out-of-the-box install of Windows will not have the administrative shares enabled. However, they are automatically turned on (unless there is a policy against it) once the system is joined to a domain. –  Iszi Jan 24 at 17:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.