Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote -1 down vote favorite

In Windows 8, Microsoft has disabled Administrative Shares. Am I opening up a security hole if I re-enable them? If I don't re-enable them, what secure alternative do I have?

share|improve this question
Do you have a source for "In Windows 8, Microsoft has disabled Administrative Shares"? They're enabled on my machine, but for all I know group policy could have done that. I really don't know. – Mark Allen Oct 24 '12 at 22:55
1  
@MarkAllen see this...computerperformance.co.uk/win8/… – Moab Oct 24 '12 at 22:56
They are very convenient (for admins) but can be a very serious security risk if you login as admin and access other computers remotely. UAC does not extend to other computers, so if your user have admin access on the remote computer and admin shares are on, then clever viruses could easily infect the remote computer or even modify system files. – billc.cn Oct 24 '12 at 22:56
@Moab Thanks, group policy must have enabled it on my machine. – Mark Allen Oct 24 '12 at 23:06
Honestly not trying to pick on you here... but as a "best practices" question this will probably be closed as well. Maybe you should head on over to chat? Then we can discuss this without worrying about closed posts. chat.stackexchange.com/rooms/118/root-access – Tanner Oct 24 '12 at 23:21
show 4 more comments

closed as not constructive by techie007, Karan, Randolph West, soandos, Sathya♦ Oct 25 '12 at 6:12

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

1 Answer

up vote 1 down vote accepted

This isn't new, it's been like that since Vista.

It's not that they are "disabled"; they are restricted from being used by local accounts. Domain admins get access to them (for example).

By default, Windows Vista and newer versions of Windows prevent local accounts from accessing administrative shares through the network.

This was done to increase the security of Windows (against things like Malware). There is no alternative (IMO) because they still work in a domain setting (unless prevented specifically), and anything you tried to use as an alternative would probably be less secure.

From the link Moab provided:

In a nutshell, hackers and robot computer attacks exploited these hidden shares, forcing Microsoft to take the ruthless approach and disable Windows 8 Administrative shares by default. Actually, this about-turn for built-in share accessibility started with Vista and continued with Windows 7, but at first few people seemed to notice.

share|improve this answer
The fact that domain admins get access if very helpful. We've been using admin shares in Win 7, so things didn't add up intil this piece of info was pointed out. – GaTechThomas Oct 26 '12 at 0:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.