Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I have a user with local admin rights on his computer, that keeps deleting the Administrative Shares on his station, i.e. \\machinename\c$ and d$

Ignoring HR and Legal actions that can be taken, my question: are these folders recreated upon login?

If not, how can I make sure that they are, and is there a way I can prevent it as long as he has local admin rights (which the answer I believe will be NO )

share|improve this question
1  
If a user is deleting the admin shares you need to have a really good look at that machine. They must be doing it to hide something. – John Gardeniers Sep 3 '12 at 13:07

1 Answer

up vote 5 down vote accepted

The administrative shares are re-created at system boot, but it is possible to disable them permanently using a registry edit.

It's highly unlikely that there will be a way of preventing him from removing them without revoking him administrative rights. If you've asked him to stop removing the shares and he's ignoring you, isn't that reason enough to remove his admin rights until he stops being a &^%$?

EDIT: It's also possible to cause the shares to be re-created by restarting the Server service, without requiring a reboot. I suppose you could schedule a task on his machine to do this overnight or something like that.

share|improve this answer
You are right, but it's office polititcs I am trying to avoid (those damm C-level rights) - The registry to disable that is not thereh (lanserver->parameters...) so he didn't add them. And as I read, only the admin share is recreated NOT the root shares. is that true? – Saariko Sep 3 '12 at 10:36
2  
The term 'Administrative shares' covers all of them - the root of each fixed drive, and the admin$ share. – Chris McKeown Sep 3 '12 at 10:37
2  
@Saariko - if someone has administrator rights, it is impossible to stop them doing whatever they like... that's the point of admin rights. You can, however, use GPOs to restrict what their account can see or do... this might be enough to discourage an idiot who likes to play with things rather than a malicious user. Ultimately though, this isn't a technical problem and while office politics aren't fun, they are a part of the job we all have to deal with. – RobM Sep 3 '12 at 11:54
Your EDIT is awsome :=-) – Saariko Sep 3 '12 at 12:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.