41

This question may be weird and misworded but I'm not a Windows expert by any means so feel free to correct me.

The group I'm in recently got new computers at work. They gave me a new computer and hooked up my old computer to the network for a week so I could take my time transferring necessary files/configs etc. The Support Guy said, "Just go to 'run' and type in \\PCNAME\c$. So I did and, low and behold, there's my old C: drive. I thought to myself, "What a huge security issue. I'll just transfer everything quickly and then 'un-share' it."

The end of the day came and I logged in through remote desktop and right clicked on the C drive. But it was not shared. I called The Support Guy and explained to him that I didn't want my C drive available to everyone on the network all weekend. He seemed confused. He said, "It's not really 'shared'. If you go to the command prompt and type in \\ANYPCNAME\c$ you get their C drive. That's just how it is."

I hung up the phone and walked over to a coworker's desk and looked at his PC name (there's a sticker on every computer) and then walked back to my desk and put a hello file on his desktop.

I don't keep anything personal on my work computer but there are definite security concerns. Not really from within the group I'm in but from the hundreds of other employees on the network (and domain) that I don't know. I'm fine with practical jokes but what if someone has an unknown grudge against me (or someone with a similar name or computer name) and adds nasty language against my boss to documents which are part of a project?

Is this an inherit part of how Windows domains work? Are there any steps I can take to make my box a little more secure? Bear in mind that I do have admin rights to the box but I can't change anything as far as the network or domain goes. Even just an explanation of what's going on would be a big help as this goes against everything that I know to be 'pretty basic' about computer systems in general. I'm more familiar with Linux so Windows World is a little foreign to me.

Follow Up

Voiced my concerns about this at work. I was told, "Nobody knows about the drive$ thing so there's nothing to worry about." Followed Darth's solution and added that registry key. Now I'll wait and see if anyone gets alerted.

9
  • 6
    That's totally nuts. There must be an easy way to disable that. Jul 15, 2011 at 20:38
  • 6
    It isn't totally nuts. It's how windows is designed and for good reason. See my further answer below. Jul 15, 2011 at 20:51
  • 13
    And no, your question is not weird in the least and you did an excellent job of describing it given your self-described non-expertness. You were observant and thoughtful, which is something I wish even a 10th of my users were. Jul 15, 2011 at 21:04
  • 4
    +1 because your concerns are reasonable and justified. Jul 15, 2011 at 21:04
  • 2
    Oh wow, that's really troubling. To add more urgency to your request, note that this probably works on workstations used by human resources as well. That's stuff I don't think the company wants arbitrary employees being able to read (much less modify!)
    – Tim Post
    Jul 16, 2011 at 0:16

6 Answers 6

38

What you're seeing is one of the Administrative Shares which is enabled on every Windows machine for all non-removable drives as \\computername\driveletter$. However, it should only be accessible to someone who is in the local Administrators group (it sounds like the Domain Administrators or Domain Users group has been added to the local Administrators group).

The sad fact of life is you can't really disable them completely without losing something else in turn (You can disable filesharing, for example, but then you can't share files...). Since they are hidden shares (as denoted by the $ at the end), you can't view them when broswing \\computername, but they will show if you type net share in a command prompt.

Disabling them shouldn't be your first course of action if Support Guy is willing to listen to a bit of reason-- Ask him to restrict the permissions that regular users have on computers over the network so that they cannot mess with each other's files, or see if he will move user profiles and documents to a server fileshare (the better, but much more involved solution).

If he can't or won't fix this, you can disable them temporarily by typing net share c$ /delete, but Windows will recreate them every time the computer is rebooted. You might be able to stick these commands into a batch file that's run on startup.

If you really wish to secure your computer, there's also hidden shares called admin$ and IPC$ which could both reveal lots of information about your computer and it's files to someone on the network which you can disable.

As pointed out in other answers, there may be programs that depend upon these shares being available, and this might get Support Guy's attention if he's trying to use one of the administrative shares to help maintain your system and can't access it.

Edit:

It seems you can disable the root partition shares (c$, d$, etc.) with the following registry key (create it if it doesn't exist):

Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0

This will not disable the IPC$ share, however.

9
  • 1
    +1 - I was going to add the info in your edit, but you beat me to it. ;) Jul 15, 2011 at 21:01
  • 14
    Deleting administrative shares is never a good starting option. There are reasons they exist and a properly secured environment suffers no security problems because of them. It is the account privileges that must be addressed first and foremost. Jul 15, 2011 at 21:22
  • 1
    @music2myear He said he didn't have control over network or domain policy, so I assumed that account privileges were not on the table of options. Besides, if he fixes this locally (say, by removing Domain Administrators from the local Administrators group), then that would have the same effect as disabling the shares (said effect being access to the shares from the network for the purpose of installing software or the like. Jul 15, 2011 at 21:26
  • 1
    This is more of an policy issue than a design issue. For example, this isn't possible where I am. But if you don't a lot of experience in Active Directory, I can see how they set it up to where anyone can do this. . .
    – surfasb
    Jul 15, 2011 at 21:48
  • 1
    Most users don't (or shouldn't) have control over network or domain policy. However, a question or query or two placed with the appropriate management or IT personnel can help begin an appropriate and probably necessary review of IT security policy. Jul 15, 2011 at 22:11
16

Your user account is probably set as Administrator on all the PCs on the network. There can be various reasons for this, most of them not the best.

Every computer on a domain has each drive shared with what is called and Administrative Share. This share is always the drive letter followed by $. As you saw it: C$. This is always available to all users whose accounts are administrators on that computer.There are good reasons for it. Most patching programs use this, as do many security programs. Also, SupportGuys like me use it for getting files to and from the computers for repair, diagnosis, troubleshooting, and user assistance, just to name a few.

You generally do not want to delete an adminstrative share unless you are sure there are no necessary programs on your network that require it. For instance: SupportGuy may need to use this share to deploy critical updates to your computer.

The problem occurs when all regular user accounts on the network as administrators. This is the problem and this is what ought to be addressed in your office. You should be users or power users, depending on the necessary permissions. With special cases given for people who actually need administrator rights.

UPDATE Addressing other answers: I would highly recommend against disabling the administrative share unless you really know there are no systems requiring it. The first course of action should be finding out why your account has domain administrator permissions and if that is really necessary. Doing this will fix security problems in the whole network, not just one little symptom problem you've discovered here. If there is no legitimate reason for you to have domain administrator rights and the SupportGuy is unwilling to remove said rights should you consider actually removing the administrative share.

4
  • 5
    Re administrator rights: This only occurs when the user is a Domain Admin, or a local Administrator on the target PC. It does not happen when the user is a local Admin on his own PC but nobody else's. Jul 15, 2011 at 20:52
  • 3
    He may not be an admin on the network as a whole. Often when setting up a computer, some admins will add the Domain User's group to the local admin group so anyone, who sites down, can install things, etc. If you do this on every computer, you have the effect of being an admin everywhere, but the servers.
    – KCotreau
    Jul 15, 2011 at 20:56
  • Which is why I used the less technical verbage "Your user account is probably set as Administrator on the network". It could have been more explicitly worded, but for a person of this ability and know-how, I felt this appropriate. Jul 15, 2011 at 20:56
  • 1
    This is situation sounds way scarier than I thought it was. I don't really want to stir the pot but I'm going to bring this up to The Support Guy or the network admin on Monday. I can't really let it slide. Jul 16, 2011 at 1:24
11

The C$ is the administrative share. You probably should not disable it, as it may break things.

The real security issue here is that it sounds like they made everyone administrators on every machine (maybe through domain users being added to the local administrators group).

In some ways that should not be an issue since, personally, I don't believe anything should be stored locally in the first place, and that "My Documents" should be redirected to your personal mapped drive on the server, which they would not have access to unless there were an even greater security lapse.

2
  • +1 for mapped My Documents. I'm considering doing that at my office as a security enhancement. Already running it on my computer and it works like a charm. Jul 15, 2011 at 21:02
  • Excellent points (+1). I find that having a user be Administrator on their local machine does avoid a lot of problems with software not functioning or installing (or updating) correctly -- it's usually much more of a hassle to not grant Administrator rights, but to grant to all machines on the network seems unnecessary. Jul 15, 2011 at 21:06
2

As everyone has said driveletter$ is a fact of windows life.

But why are you an administrator on you co-workers desktop? And.. I would confirm is he an administrator on your desktop? THIS is the real issue here.

Even if you were to remove the admin share.. there is nothing preventing people from logging onto your desktop and accessing your files because they are an administrator on your machine. The share, is just a handy way to bypass logging on.

Since you're an admin on your machine, I would take a look at the admin group, add yourself explicitly and then remove the domain users group that is probably there.

1
  • 1
    This is the bigger danger. I guess it wasn't obvious, but people who are recommending to disable admin shares are missing the big picture. Who else has admin right? Considering your role in the company isn't unique, this would scare me more. If yourself has network wide admin rights, who else??????
    – surfasb
    Jul 16, 2011 at 6:21
1

Right click on "Computer" (Start Menu)

Select "Manage"

Expand "Shared Folders"

click "Shares"

in the right pane you will see all the shares on that PC, any with $ are hidden shares, you can right click on C$ and select "stop sharing"

As suggest by Darth, the share will be recreated upon reboot.

You can disable it in the registry but I don't think your company would appreciate this.

You can also disable file sharing in the Windows Firewall, but this will kill all file shares.

.

1
  • And it will give you the warning "This share was created for administrative purposes only. The share will reappear when the Server service is stopped and restarted or the computer is restarted. Are you sure you wish to stop sharing C$?" Jul 15, 2011 at 20:50
0

The Wikipedia page on administrative shares should answer your questions. Basically in order to access those shares your account is either directly or indirectly (most likely) part of the local administrative group on all of the computers.

One way to view the groups you are in is by running via the command line: gpresult /R. Personally your IT department sounds inept if all users have local admin access to all computers. With that said I feel like you still shouldn't tweak things but this is what I would do:

  • Open computer management (right-click Computer, manage)
  • On the left select: System Tools\Local Users and Groups\Groups
  • Double click the Administrators group.

Everyone who is a member or a member of a group in the Administrators group will have access to your administrative shares. The first thing I would do is add your account directly if its not already there as a fail-safe if you start having too much fun... Now you can go about breaking things by removing users/groups you don't want to have access.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .