Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am trying to get Symantec Endpoint Protection working (trial). I have succeeded but found that on the windows xp machines I need to turn off simple file sharing and share admin$ and c$ as admin shares. Is there a clever way of automating these settings? I really dont want to touch all the machines in the network.

Thanks

share|improve this question
    
I have found that there is a group policy object that you can set to disable Simple File Sharing however it isnt called this...See below. Just need to solve the admin$ abd c$ Rollout now. Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts Set this policy to Classic - local users authenticate as themselves. When this policy applies to the client, it sets the following registry key to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest –  JohnyV Feb 26 '10 at 1:41
    
Just turn off simple file sharing. The administrative shares are already there. –  John Gardeniers Feb 26 '10 at 1:44
    
No this doesnt work. The shares had been removed by someone before my time so i need to re-add them. –  JohnyV Feb 26 '10 at 2:13
1  
The admin$\drive$ shares will automatically be recreated on reboot unless actively suppressed by something else. It is not possible to just "remove them" without disabling some fundamental parts of the network stack. –  Helvick Feb 26 '10 at 2:54
    
there must be something actively suppressing them then because even after a reboot the machines still dont have the shares. I will have a look. –  JohnyV Feb 26 '10 at 5:06
show 4 more comments

3 Answers 3

up vote 0 down vote accepted

How about those 2?

http://www.petri.co.il/disable_administrative_shares.htm

http://windowsitpro.com/article/articleid/44621/q-how-can-i-use-group-policy-to-control-whether-the-default-administrative-shares-are-created.html

share|improve this answer
    
I did find these references but the custom ADM did not work. I had to modify it to get it to work and it then worked. i used a combination of the 2 to get it to work. Thanks. –  JohnyV Feb 28 '10 at 10:25
    
Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Mark Henderson Sep 26 '12 at 6:25
add comment

If your machines are joined to a domain, simple file sharing is turned off automatically, so I'm guessing there's no domain environment here. Actually, I don't think simple file sharing can be used at all in a domain environment.

Do you run a domain for your production network? If so, is your test machine connected to the domain? If not, this is the root of your issue.

We can provide workarounds if you're in a workgroup environment, but a domain would be preferable to reduce your hassle.

share|improve this answer
    
No it is a domain environment. And the test machine is on the domain. I had to change these settings manually on this machine and I checked another in the domain and the same issue was present –  JohnyV Feb 26 '10 at 1:09
add comment

I would create a GP to recreate the shares via a boot script, or just add the following to the user logon scripts. May require the user to have local Admin rights on the wkstn.
Net Use Admin$
Not sure if that will work with the C$ share.

http://support.microsoft.com/default.aspx?scid=kb;en-us;842715

If the logon user must be a local admin then you can do that temporarily via GP by:
Create an AD Group called Local_Wkstn_Admins
Add all of the users to that group in AD Using a boot script via GP, add the Local_Wkstn_Admins group to the local Administrators group.
After 24-48 hours then either remove the Local_Wkstn_Admins from the local Administrators Group and/or remove all users from the AD group Local_Wkstn_Admins.
Above is not perfect security but a way to get it done!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.