up vote 2 down vote favorite
share [g+] share [fb]

A user on my network (my predecessor in fact) disables the admin shares with a batch file that runs every time the computer starts up. I would like to disable this without the users knowledge. I would also like to do this remotely and at will. Is this possible?

This user no longer has an IT role in the company but likes to use their knowledge to circumvent our companies acceptable use policy. I have screen shots of the various files and folders that could serve as evidence, but I'm not sure how far I would get if I inform his superiors (office politics). Any suggestions on this front would be appreciated as well.

The machine in question is Windows 7 Pro 32-bit. We use Server 2003 for our Domain.

UPDATE: I used a GPO to disable the computers on my network from remembering the last user and then played the "I'm stupid, remember?" card when I feigned ignorance of why this was happening. I also discovered that if the computer is power cycled the shares are recreated (I knew this part) but aren't deleted until AFTER he logs on to the box in question. In retrospect I should have realized this.

I would still like any suggestions that I can use Group Policy on the Domain level to limit his destruction to his own box. I would also like to make sure that tosser can't log on to any computer in the network but his own.

link|improve this question
4  
Is he an administrator on his local machine? If he has a local administrator account, physical access, and knowledge he will be able to override anything you try to do. – Zoredache Aug 24 '10 at 16:45
+1. You could try enforcing this via GPO – gWaldo Aug 24 '10 at 16:55
feedback

3 Answers

up vote 7 down vote accepted

Though there may be a technical solution to this, it's really more of a policy/HR issue. Inform that user's manager of the situation as well as the HR department. If they turn a blind eye to the situation, then there's not a whole lot left for you to do. In this situation, they're implicitly condoning his behavior and even if you disabled his ability to turn off the admin share, you'd likely hear about it and be asked to re-enable the user to continue his behavior.

Does this user have administrative privileges? (I'm assuming yes) Short of removing these, I'm not sure how you'd prevent him from disabling the admin share.

link|improve this answer
+1. Agreed; Circumventing policy is a HR issues. – gWaldo Aug 24 '10 at 16:57
I'd second this. I would guess that his (new?) boss doesn't know about this behaviour. – ChrisF Aug 24 '10 at 16:57
1  
You don't need admin shares in order to gather evidence of that. The proxy and/or firewall logs should be more than enough. – Massimo Aug 24 '10 at 17:10
1  
In addition to what Massimo suggested, mirror the switchport that his workstation is plugged into and fire up wireshark. That should be all the evidence you need. – ErikA Aug 24 '10 at 17:12
1  
Unmanaged HP switches? I wasn't even aware that they made anything other than managed switches. Anyway, do you happen to have a small hub (not a switch, needs to be a hub) around? If so, put that in line between his workstation and the switch. Then you should be able to connect your wireshark machine to any of the hub's ports and get an exact copy of the traffic that is being sent/received from this user's machine. – ErikA Aug 24 '10 at 17:22
show 6 more comments
feedback
up vote 0 down vote

This isn't a very elegant solution, but you could just create a scheduled task to re-enable the admin share, and have it run every hour. If he has permissions to add/remove scheduled tasks, then he could disable the task as well, but you could also use a group policy to prohibit him from accessing that particular MMC snapin. (Scheduled tasks in Windows 7 are an MMC snapin, whereas in XP and Server 2003 they are not, so you may need to make these configurations from another Windows 7 computer, not from the DC, since I don't think the tasks plugin will appear on the DC.)

link|improve this answer
This is something I could do without physical access and without his knowledge? If it wasn't a silent process the user would quickly see something was up. I do have the ability to use group policy to restrict his access to certain areas of the network (which earns me a great deal of snide remarks I might add lol). – Hannibal Aug 24 '10 at 17:11
You could definitely do it remotely as long as you have the proper credentials to do so. He might notice the effects, but unless he regularly hangs out in the task scheduler, I doubt he'd see it unless he goes looking. In order to do it remotely, open up mmc.exe, click File -> Add/Remove snapin, and select "task scheduler", then click "add". When prompted, select "another computer" and enter the name of the user's computer. Once connected, you should be able to add/remove tasks. Again, you'll need to do this from a Win7 or Server 2k8 machine, not server 2003. – nhinkle Aug 24 '10 at 22:05
I have the credentials. I had no problem following your directions, however, once I get to "you should be able to add/remove tasks" I have no idea what type of task I should create. I thought about writing another batch file, but I can find the commands I would use to recreate these share from the command line. Google only reveals ways of disabling these shares... – Hannibal Aug 25 '10 at 18:47
Hmm. Is there a way for you to reverse the process that he used to disable them? If you could provide a link to some info on how the disabling works, I can look at it and see if I can think of a way to re-enable it. That also gives me the other thought that you could perhaps find a way to simply remove his ability to disable the share in the first place, though at the moment I can't think of a way to do that. – nhinkle Aug 26 '10 at 21:43
He uses a .bat in his startup folder with 3 net use commands NET SHARE C$ /delete NET SHARE D$ /delete NET SHARE admin$ /delete There was a suggestion to disable the use of the NET command all together but these are used to setup shares when a user logs into their computers. – Hannibal Aug 27 '10 at 16:58
show 1 more comment
feedback
up vote 0 down vote

Regardless of this being an HR issue or not, the problem still exists that a user has the capability to circumvent policy. While contacting HR is a must on the list (the user is doing it on purpose), the next item on the list is to ensure it does not happen again.

As far as management making you change the settings back, I find this grossly unlikely, since the user is in effect making their machine "unmanageable," and therefore it is now a vulnerability.

First off, make sure the user isn't an administrator on the computer. Second, you can enforce a group policy to disable whatever program the user is using in their script to disable those shares.

http://blog.thejoshmeister.com/2004/12/disabling-applications-with-active.html

link|improve this answer
This is the script the user has in their startup folder as a batch file... NET SHARE C$ /delete NET SHARE D$ /delete NET SHARE admin$ /delete There is a script that runs when users login to their computers that adds the shared folders on our main server. Would a batch file in the startup folder run after the login script? if not then I could add the admin shares to the login script and the user would not likely notice... – Hannibal Aug 24 '10 at 18:16
@user52180: No offense, but if you're just playing his game, it probably won't work well for you. If you don't resolve the root issue (local admin access, no support from HR for AUP) then you can't stop him from manually performing the same actions. Adding another layer of scripting in order to out-fox him isn't very efficient use of your time. – jscott Aug 24 '10 at 18:34
Startup scripts in that folder run last. As the previous comment above states, you still need to contact your HR, and be able to cite policy specifically (By page and paragraph). You can also move or rename the NET.exe program so that it will no longer work. Also, I can't stress enough that you remove his administrator privileges from the box if he has them. You will never win this battle if he has admin privileges locally. – IceMage Aug 24 '10 at 18:42
@jscott: I appreciate your comment but so far my appeals to management have been countered by the users 1) seniority, 2) managements gullibility, and 3) his ability to manipulate the right people to look the other way. My problem is that I need to secure my network and if I can't do it with their help I will find other means. Any suggestions you have will be greatly appreciated.. Aut viam inveniam aut faciam! -Hannibal – Hannibal Aug 24 '10 at 18:50
@IceMage I commented above... "I tried to remove access company wide so as not to single this person out but the user went above my head and was excluded from the policy on the grounds that they "need to be able access their computer and they had already proven their capability support themselves". The problem is this user like to use our Internet access for his own personal torrent free-for-all. I have been trying to gather evidence of this behavior using the admin shares because it doesn't (as far as I know) show that I have been accessing his computer." – Hannibal Aug 24 '10 at 18:52
show 3 more comments
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.