Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to write a script that will audit shared folders on a few HIPAA-sensitive servers. I'm getting a list of shares just fine using gwmi Win32_Share, however when I go to get the permissions on each share using gwmi Win32_LogicalShareSecuritySetting, the hidden administrative shares are not listed.

I realize that's for obvious reasons, it's not like the permissions change, but I would like some kind of indication that this is in fact an administrative share. Currently I'm using a try-catch block to handle the error and kicking out a 'permissions could not be found' message.

Is there any way I can list ONLY hidden administrative shares using PowerShell?

share|improve this question
up vote 4 down vote accepted

Try (change "." to your remote computer name):

[String]                                   $Local:strComputerName  = ".";
[System.Management.ManagementBaseObject[]] $Local:arrShares        = @();
[System.Management.ManagementBaseObject]   $Local:objShare         = $null;

$arrShares = Get-WMIObject -class "Win32_Share" -namespace "root\CIMV2" -computername $strComputerName -ErrorAction SilentlyContinue | Where-Object { $_.Type -eq 2147483648 };
if ( $? ) {
    foreach ( $objShare in $arrShares ) {
        # List attributes (other attributes include AccessMask, AllowMaximum, Description,
        # InstallDate, MaximumAllowed, Status and Type).
        Write-Host -Object ( "Name        : {0}" -f $objShare.Name );
        Write-Host -Object ( "Path        : {0}" -f $objShare.Path );
        Write-Host -Object ( "Caption     : {0}" -f $objShare.Caption );
        Write-Host -Object "";
        } #foreach
} else {
    Write-Host -Object "ERROR.";
} #else-if
share|improve this answer
Ah, guess I should have been more clear. I need to list only administrative shares, so I can differentiate between those and hidden shares. – Tanner Faulkner Oct 4 '13 at 20:38
Looks like adding -Filter "type=2147483648" to gwmi "Win32_Share" will display only admin shares. "type=0" will show only disk drive shares. – Tanner Faulkner Oct 4 '13 at 20:52
Updated - see end of Get-WMIObject line... – Simon Catlin Oct 4 '13 at 21:00
I tried this script and changed the "." to "HisComputer" and the console says "ERROR" – bgmCoder Feb 22 at 22:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.