2

Every PC can map to any other PC's hard drive(s) / USB drive(s) on the network where I work. When I realized this I thought it was odd. All one needs to do is access the (Start) button then type \\ComputerName\C$ and they can read, write and delete from any drive. Is this a common network configuration? There are approx 200 PCs across all the common types of departments you'd have in any business. The internal politics are raging at times. Tensions are very high at times. Can anyone explain how this, perceived lack of security on my part, configuration might make sense?

Additional info: I asked a network administrator why the network was like this, her answer was similar to "Yes, everyone can access other drives, we need to install updates etc. Save sensitive data to your network share where 'most' others can't access it." The problem with this is. 1) the network shares are limited in storage capacity and folks are routinely asked to remove unneeded files from the shares, resulting in people using their local hard drive(s) instead. and 2) Only a few people know that everyone can access their local drive(s)

  • 1
    Your perceptions are correct.. – KDEx Mar 10 '15 at 2:44
  • 1
    Are the users of the workstations logging in as local administrator accounts? (Bad idea, man). Did some sysadmin add the Domain User Group to the local admins group? More details please. – boggart Mar 10 '15 at 3:39
  • @boggart, Don't the know answer to your questions but. I asked a network administrator why the network was like this, her answer was similar to "Yes, everyone can access other drives, we need to install updates etc. Save sensitive data to your network share where 'most' others can't access it." The problem with this is. 1) the network shares are limited in storage capacity and folks are routinely asked to remove unneeded files from the shares, resulting in people using their local hard drive(s) instead. and 2) Only a few people know that everyone can access their local drive(s) – Rose Mar 10 '15 at 4:06
  • 2
    Wow. That's just incorrect. It is not necessary to supply workstations with access to every other workstation to push updates. If any one user in your office gets hit with cryptolocker, every workstation is going down. If any one user becomes hostile to the company, it would be trivial to plant malware. Sounds to me like sysadmin is taking a lazy shortcut. You have to negotiate office politics in your own judgment, but this is a serious security issue and if it were me I would escalate within the organization. – boggart Mar 10 '15 at 4:18
  • 1
    It sounds like they've confused "make drives accessible to administrators" with "make everything available to everyone", which is Bad and Wrong. – pjc50 Mar 10 '15 at 14:42
2

These shares are call "administrative shares". They are there to enable the smooth working of pretty much all network management tools.

They aren't a security risk unless you explicitly make them one: by default, they aren't accessible but by an admin account and such an account and local admin accounts can only be used remotely if they have a password assigned to them (at least in all supported vers versions of windows, i.e. anything above XP).

Your other questions are irrelevant: if someone has access to an account on your machine that is member of the "administrators" group, they effectively have all rights on your machine (so musing about "limited capacity" for removable drives is the least of your worries if these access are unlimited).

  • My concern is that every PC on the network can access the local drives on any other PC on the network. They can map to the C: drive, USB drives etc. with the ability to read, write and delete files. – Rose Mar 10 '15 at 12:47
  • 1
    Only if you manually enable access to these drives, have changed the default security policy to allow blank password on admin accounts or if you're using the same credentials (username and password) on every machine. Each of these represent a basic failure of good security practice, not a technical issue – Stephane Mar 10 '15 at 12:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.