By default, Windows NT and
Windows 2000 share every drive (with share
names C$, D$, etc.) and the Windows directory
(with share name ADMIN$) when the system
is booted. Although
these shares are only accessible to members
of the Administrators group they can compromise
security because it is not uncommon for
systems to have
an insecure local-administrator password.
You can remove these shares permanently
by editing the registry:
- Log on as an administrator.
- Run the Windows
NT registry editor (Click on Run on
the Start Menu and type regedit).
- Locate HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\LanmanServer\Parameters.
- If
you are using Windows NT Server change
the registry value "AutoShareServer" to
0 (zero). If this value does not exist
create a new DWORD value using the
New menu command on the Edit menu.
- If
you are using Windows NT Workstation
change the registry value "AutoShareWks" to
0 (zero). If this value does not exist
you need to create it as above.
- Reboot and the
shares will not be recreated.
Note that Microsoft Systems Management Server
and some network backup
software rely on these shares - check
that they are not required before deleting
them.
Next
Windows Tip |