0

I am going to the network+ class, and today my teacher said that every time you want to configure a network, disable the hidden share of hard drives in windows. He said that if this is enabled, you will be hacked very easily. Is that correct while anyone who want to access shared drives must has the administrator permission?

And also as I searched, to disable this configuration permanently I have to disable the administrative share completely. What problems may happen if this feature is disabled?

Thanks.

  • What problems may happen if this feature is disabled? Do you want some honest person to access all your files in order to help you with something? No? Then there are no problems. – deviantfan Aug 8 '16 at 19:05
  • That's right @deviantfan. I think that it can be really helpful in some situations. But is there any security challenges when this feature is enabled? – T.Sh Aug 8 '16 at 19:20
  • Maybe not the answer you want, but if you're concerned about things like that, it's time to throw Windows out. Admin shares are just one hole in swiss cheese. Such feature are nice if I want to help my grandma if she can't remember something again, but else? Many things can be made (a bit more) secure, with much work, but ... well, I personally would not bother. – deviantfan Aug 8 '16 at 19:37
3

Admin shares only permit access over the network to users that are members of the computer's local Administrators group. You can disable them by configuring the AutoShareServer (for server OS) or AutoShareWks (for non-server OS) registry values:

Hive: HKEY_LOCAL_MACHINE
Subkey: System\CurrentControlSet\Services\LanmanServer\Parameters
Value name: AutoShareServer (server OS) or AutoShareWks (for non-server OS)
Value data: 0
Value type: REG_DWORD

(See https://support.microsoft.com/en-us/kb/288164)

There may be negative implications for disabling them--see https://support.microsoft.com/en-us/kb/842715.

Your teacher may be misunderstanding the scope of this feature. As noted, the admin shares are only accessible to members of Administrators (hence the name). If someone is a member of Administrators that is not supposed to be a member of Administrators, they already have the highest level of access anyway. Another way to say this: Disabling the admin shares doesn't prevent hacking; if a hacker can access them, you've been hacked already.

  • 1
    I concur. Disabling a default-on privileged features like this in an managed, enterprise environment (i.e. with Active Directory) is rarely useful. Any person/process that has access can find a million other vectors to access the same things. – billc.cn Aug 16 '16 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.