0

I am trying to get Symantec Endpoint Protection working (trial). I have succeeded but found that on the windows xp machines I need to turn off simple file sharing and share admin$ and c$ as admin shares. Is there a clever way of automating these settings? I really dont want to touch all the machines in the network.

Thanks

  • I have found that there is a group policy object that you can set to disable Simple File Sharing however it isnt called this...See below. Just need to solve the admin$ abd c$ Rollout now. Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Network access: Sharing and security model for local accounts Set this policy to Classic - local users authenticate as themselves. When this policy applies to the client, it sets the following registry key to 0: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\forceguest – JohnyV Feb 26 '10 at 1:41
  • Just turn off simple file sharing. The administrative shares are already there. – John Gardeniers Feb 26 '10 at 1:44
  • No this doesnt work. The shares had been removed by someone before my time so i need to re-add them. – JohnyV Feb 26 '10 at 2:13
  • 1
    The admin$\drive$ shares will automatically be recreated on reboot unless actively suppressed by something else. It is not possible to just "remove them" without disabling some fundamental parts of the network stack. – Helvick Feb 26 '10 at 2:54
  • there must be something actively suppressing them then because even after a reboot the machines still dont have the shares. I will have a look. – JohnyV Feb 26 '10 at 5:06
0

How about those 2?

http://www.petri.co.il/disable_administrative_shares.htm

http://windowsitpro.com/article/articleid/44621/q-how-can-i-use-group-policy-to-control-whether-the-default-administrative-shares-are-created.html

  • I did find these references but the custom ADM did not work. I had to modify it to get it to work and it then worked. i used a combination of the 2 to get it to work. Thanks. – JohnyV Feb 28 '10 at 10:25
  • Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Mark Henderson Sep 26 '12 at 6:25
0

If your machines are joined to a domain, simple file sharing is turned off automatically, so I'm guessing there's no domain environment here. Actually, I don't think simple file sharing can be used at all in a domain environment.

Do you run a domain for your production network? If so, is your test machine connected to the domain? If not, this is the root of your issue.

We can provide workarounds if you're in a workgroup environment, but a domain would be preferable to reduce your hassle.

  • No it is a domain environment. And the test machine is on the domain. I had to change these settings manually on this machine and I checked another in the domain and the same issue was present – JohnyV Feb 26 '10 at 1:09
0

I would create a GP to recreate the shares via a boot script, or just add the following to the user logon scripts. May require the user to have local Admin rights on the wkstn.
Net Use Admin$
Not sure if that will work with the C$ share.

http://support.microsoft.com/default.aspx?scid=kb;en-us;842715 http://support.microsoft.com/default.aspx?scid=kb;en-us;842715

If the logon user must be a local admin then you can do that temporarily via GP by:
Create an AD Group called Local_Wkstn_Admins
Add all of the users to that group in AD Using a boot script via GP, add the Local_Wkstn_Admins group to the local Administrators group.
After 24-48 hours then either remove the Local_Wkstn_Admins from the local Administrators Group and/or remove all users from the AD group Local_Wkstn_Admins.
Above is not perfect security but a way to get it done!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.