I recently noticed that many Windows 8.1 Pro workstations do not have hidden shares, such as admin$ enabled. I need to have such shares available for remote app deployment. I noticed that RSAT installation automatically enables administrative hidden shares on client computers that RSAT is installed. Hence my question, is there a way to deploy RSAT by GPO?
Since it comes as an update package I could use wusa and script installation but I do not want to break open door if there is a better option.
-
If the workstation does not have a need to have RSAT, then it violates the security principal of Least Privilege.– DavidwAug 29, 2015 at 1:14
-
@davidw not really. RSAT doesn't grant any rights; it provides a nice interface for users to use rights they already have. Restrict using explicit controls. Not to say this is a good reason to install RSAT though.– Falcon MomotAug 29, 2015 at 1:27
-
@Falcom Momot - thanks. This was merely a workaround. I can't afford to spend too much time on that project and it is >10 workstations so I was letting myself less-than-optimal approach.– Art KubickiAug 31, 2015 at 14:09
Add a comment
|
1 Answer
Think long and hard about deploying a software package merely for the purpose of enabling some shares. Then keep thinking about it until it seems like a bad idea ;-)
Instead, maybe try just enabling the admin shares via GPO. The specific values you are interested in are:
HKLM\System\CurrentControlSet\Services\lanmanserver\parameters
AutoShareServer and AutoShareWks are the values you need to add with a value of 1 (if not present)
Edit: Where this is located in the GPO editor escapes me at the moment - been a while since I dealt with domains and GPOs.
-
1Agree that the OP's proposed solution is a bad way to resolve the issue. Aug 28, 2015 at 23:55
-
That's what I was looking for. Thanks. I can script it in powershell or I'll just look for GPO template. If you recall the template, please post it. Thanks again. Aug 31, 2015 at 14:04