up vote 0 down vote favorite
share [g+] share [fb]

I am trying to get Symantec Endpoint Protection working (trial). I have succeeded but found that on the windows xp machines I need to turn off simple file sharing and share admin$ and c$ as admin shares. Is there a clever way of automating these settings? I really dont want to touch all the machines in the network.

Thanks

link|improve this question
87% accept rate
I have found that there is a group policy object that you can set to disable Simple File Sharing however it isnt called this...See below. Just need to solve the admin$ abd c$ Rollout now. Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts Set this policy to Classic - local users authenticate as themselves. When this policy applies to the client, it sets the following registry key to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest – JohnyV Feb 26 '10 at 1:41
Just turn off simple file sharing. The administrative shares are already there. – John Gardeniers Feb 26 '10 at 1:44
No this doesnt work. The shares had been removed by someone before my time so i need to re-add them. – JohnyV Feb 26 '10 at 2:13
1  
The admin$\drive$ shares will automatically be recreated on reboot unless actively suppressed by something else. It is not possible to just "remove them" without disabling some fundamental parts of the network stack. – Helvick Feb 26 '10 at 2:54
there must be something actively suppressing them then because even after a reboot the machines still dont have the shares. I will have a look. – JohnyV Feb 26 '10 at 5:06
show 4 more comments
feedback

3 Answers

up vote 0 down vote accepted

How about those 2?

http://www.petri.co.il/disable_administrative_shares.htm

http://windowsitpro.com/article/articleid/44621/q-how-can-i-use-group-policy-to-control-whether-the-default-administrative-shares-are-created.html

link|improve this answer
I did find these references but the custom ADM did not work. I had to modify it to get it to work and it then worked. i used a combination of the 2 to get it to work. Thanks. – JohnyV Feb 28 '10 at 10:25
feedback
up vote 0 down vote

If your machines are joined to a domain, simple file sharing is turned off automatically, so I'm guessing there's no domain environment here. Actually, I don't think simple file sharing can be used at all in a domain environment.

Do you run a domain for your production network? If so, is your test machine connected to the domain? If not, this is the root of your issue.

We can provide workarounds if you're in a workgroup environment, but a domain would be preferable to reduce your hassle.

link|improve this answer
No it is a domain environment. And the test machine is on the domain. I had to change these settings manually on this machine and I checked another in the domain and the same issue was present – JohnyV Feb 26 '10 at 1:09
feedback
up vote 0 down vote

I would create a GP to recreate the shares via a boot script, or just add the following to the user logon scripts. May require the user to have local Admin rights on the wkstn.
Net Use Admin$
Not sure if that will work with the C$ share.

http://support.microsoft.com/default.aspx?scid=kb;en-us;842715

If the logon user must be a local admin then you can do that temporarily via GP by:
Create an AD Group called Local_Wkstn_Admins
Add all of the users to that group in AD Using a boot script via GP, add the Local_Wkstn_Admins group to the local Administrators group.
After 24-48 hours then either remove the Local_Wkstn_Admins from the local Administrators Group and/or remove all users from the AD group Local_Wkstn_Admins.
Above is not perfect security but a way to get it done!

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.