-3

I came across to a security weakness that potentially can put information at risk in my organisation.

Whenever I access other's computer in the network through the command:

\\192.168.20.4\c$

I get prompted the username and password. If I type my AD login, I get successfully access to other's computer root folder, which allows me to browse his/her files.

How can I avoid this?

Improve this question
2
  • 2
    If that share can "potentially put information at risk in [your] organisation", your permission structure is broken to the core.
    – Daniel
    Apr 12, 2015 at 14:15
  • This is not so much a weakness as it is working as designed. It sounds like you have local administrator privileges in AD, which sounds like the bigger security risk.
    – DTK
    Apr 12, 2015 at 17:20

1 Answer 1

Reset to default
2

So called "dollar shares" are hidden, but automatically shared and access is granted to all local administrators of the computer. The fact that you can access it implies you are an admin on the remote machine.

You cannot edit their security properties, but you can remove them.

That said, you could technically delete the c$ share and recreate it as a non-administrative share, at which point you could edit its permissions.

Open Computer Management and go to Shared Folders > Shares. From here you can delete the shares, if you so wish.

Improve this answer
2
  • Thanks! Is it possible to view the history of users that accessed the "dollar share" ?
    – Andre
    Apr 12, 2015 at 20:23
  • Access attempts will show up in the Security Event Log. To get just share access you'd have to do some filtering, but it would be there.
    – Taz
    Apr 13, 2015 at 0:50

Not the answer you're looking for? Browse other questions tagged .