Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We use a system to name every PC, we use this way: each workstation starts with WS followed by a number. So PC 14's name = WS14 and PC number 1 is WS01.

What I discovered now is that when I try (from PC WS15) to access this location \\WS14\c$

It will show me all contents available on the C:\ drive on the other PC. Is it possible that only domain administrators can access this drive instead of ALL users in the domain?

I've seen this method, but it will block it for anyone. And that's not the solution I'm looking for.

 Open the HKEY_LOCAL_MACHINE branch.
    Open the SYSTEM branch.
    Open the CurrentControlSet branch.
    Open the Services branch.
    Open the LanmanServer branch.
    Select the Parameters branch.
    Select Edit, New, DWORD (32-bit) Value. Vista & Windows 7 adds a new value to the Parameters key (If you have the key just check for correct value).
    Type AutoShareWks and press Enter. (You can leave this setting with its default value of 0.)

note: i don't know what tags I should add, feel free to suggest an edit.

share|improve this question
Is this in an Active Directory environment, or workgroup? – sysadmin1138 Oct 25 '12 at 11:52
Active directory. – Rob Oct 25 '12 at 11:53
The default behavior is that only Administrators can do this. Are all of your users administrators on all if the workstations? – MDMarra Oct 25 '12 at 11:59

2 Answers 2

up vote 5 down vote accepted

That share is what's called an Administrative share, and the default permissions only allow members of the local Administrators group access.

So either you are logged in with a Domain Admin account, or the permissions have been customised somewhere along the way.

share|improve this answer
Everyone is local admin at his own PC, we develop software and every engineer is allowed to download and install software on the pc without the need of asking a system admin. I think that's the problem. – Rob Oct 25 '12 at 12:08
@Robuust Being a LOCAL administrator (as in adding the domain user to the local administrator group on the client PC) does not make them administrators across the domain. They can't see other computers/servers administrative shares unless you put users in the domain admins group. Which is a very, very, very, very bad idea. – pauska Oct 25 '12 at 12:29
If you are not a domain admin in this scenario, then you must be a local admin on the remote PC whose admin share you're accessing. – ThatGraemeGuy Oct 25 '12 at 13:07
OR you ahve the same passwords everywhere - and thus make a mockery out of the security system. – TomTom Aug 14 '13 at 22:13

You said that everyone is a local admin of their own PC... do they log into their PC's as WSxx\Administrator

If so that effectively allows pass through to the other machines as the administrator account on that machine. Hence the problem you are experiencing.

It would be best to disable the default local administrator account on all of the machines and then create a unique one so you would have for example WS01\WS01Admin.

Then get your users to logon as DOMAIN\Username (which has only Domain User permissions) and each time they need to do something as Administrator they can elevate using their WS01\WS01Admin account.

share|improve this answer
Everyone logges in under the domain with their own credentials. But everyone in our group (dept01) is local admin on his own pc for installing stuff etc. – Rob Oct 25 '12 at 12:36

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.