3

I have installed windows server and it produces default shared folders that users can see when they are looking at other folders I have shared for them. Is there a way to hide these system folders or at least stop the domain users from seeing them without breaking the server. Microsoft suggest that you should not remove these shares.

Some of the folders are listed below,

  • clients
  • NETLOGON
  • SYSVOL
  • tsclient
  • Users

The hidden shares are below also:

  • C$
  • print$
  • Resources$

How do most people change these folders after installation? From what I can see most people remove the C$ share and thats about it.

7
  • 1
    What are you trying to accomplish by "hiding" these shares? They all server a purpose, do you understand what purposes each serve and are you prepared to break that functionality? Most people do not modify these shares in any way. Except Users and clients - those are not default share, to my knowledge. Someone must have shared those out without your knowledge.
    – MDMarra
    Jan 5, 2014 at 18:56
  • They might be SBS 2011 defaults. (Guessing.) Jan 5, 2014 at 19:04
  • When domain users browse to the server they are complaining about the excess number of shares (they appear to have read permissions for everyone). They were expecting one or two folders but see many, for me its not a big deal, but is causing confusion. I am not prepared to break functionality simply looking for a way to make the folders less visible. Jan 5, 2014 at 19:07
  • 1
    Maybe you could use group policy to map shares for them and train them to look at what's mapped on their computer instead. Jan 5, 2014 at 19:13
  • 2
    John, I get what you're saying but sometimes you just need to tell users that's the way it is. Modifying, deleting or otherwise manipulating the default shares is only going to lead to frustration. I don't know how a car engine works but that doesn't stop me from driving one and I don't get confused by looking at all of the engine components. I assume that all of the components are necessary to make the car work and I concern myself with only those components that I'm required to interact with in order to drive it.
    – joeqwerty
    Jan 5, 2014 at 19:26

2 Answers 2

8

Why are your users browsing somewhere that they can see this in the first place? There are a few things I'd like to address, so bear with me.

  1. It appears you're using a domain controller as a file server if your users are seeing NETLOGON and SYSVOL. Don't do this. Have your domain controllers run AD DS, DNS, and nothing else if at all possible.

  2. You don't want to modify permissions on NETLOGON/SYSVOL unless you really know what you're doing. This will likely result in broken Group Policy processing on clients.

  3. You probably don't want to modify the C$ share. By default, only administrators can access C$. Certain applications like the SCCM client and ADMT use it for software/agent delivery to the client. Only disable this share if you really know what you're doing - in it's default state it's not dangerous since only Administrators can use it.

  4. Consider mapping the shares that your users will need using GPO. Then, they don't need to browse to any servers and enumerate these additional shares that you don't want them to see. This is very easy to do using Group Policy Preferences (GPP).

  5. If your users really must browse to a UNC to get these shares, set up a DNS namespace like \\example.com\shares\ and have each share listed there. This will have the benefit of only displaying the shares that you configure as part of the namespace.

Really though, don't go fiddling with things unless you really understand their purpose, otherwise you might end up breaking things that you didn't anticipate breaking. Very few people have a reason to modify these shares (except for Users and clients which I don't believe are default shares).

3
  • I suspect the OP is using SBS. It's set up by default with shares on the DC. Jan 5, 2014 at 20:37
  • That was my thought as well, but it's tagged windows-server-2003
    – MDMarra
    Jan 5, 2014 at 20:45
  • Huh, you're right, I missed that. There was an SBS 2003, though. Jan 5, 2014 at 20:49
4

Rather than worrying about "hiding" them, you should put appropriate permissions on them. It doesn't matter whether or not people see they exist. What matters is whether people can access things they shouldn't.

1
  • 2
    I'll add that you really shouldn't modify the permissions on NETLOGON/SYSVOL unless you really really really know know you're doing.
    – MDMarra
    Jan 5, 2014 at 19:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .