Re: A Hack Attack and IPC$

From: John Cesta (support_at_serverautomationtools.com)
Date: 08/09/03 

Date: Sat, 09 Aug 2003 15:13:10 -0400

On Sat, 09 Aug 2003 18:50:13 GMT, Lars M. Hansen
<badnews@hansenonline.net> wrote:

>On Sat, 09 Aug 2003 14:07:39 -0400, John Cesta spoketh
>
>>
>>My basic question: I know there is a way to delete the IPC$ share
>>during a session but is there a way to delete the share so it does not
>>create on reboot?
>>
>>Read the following if you need to know why this is important.
>>
>>Also, I hope this never happens to you.
>>
>>On M$ systems there are administrative shares that are created
>>automatically. Some of these admin shares include: C$, D$, ADMIN$ and
>>most importantly, IPC$ (a remote share).
>>
>
>Simple: change/set the value of "AutoShareServer" to zero in the
>HKLM\System\CurrentControlSet\Services\LanManServer\Parameters
>
>That'll disable all the admin shares.

I think... except for IPC$

1. Note that these methods do not remove the IPC$ share or existing
shares that have been manually created.

2. NOTE: A setting of zero (0) prevents the administrative shares,
such as C$, D$, and Admin$ from being created automatically.

Thanks,

John

>
>If it's a workstations, the proper value is named "AutoShareWks".
>
>
>Lars M. Hansen
>http://www.hansenonline.net
>(replace 'badnews' with 'news' in e-mail address)
>"You're an angel with your wings broken"

Relevant Pages

  • Re: A Hack Attack and IPC$
    ... > during a session but is there a way to delete the share so it does not ... > On M$ systems there are administrative shares that are created ... Some of these admin shares include: ... > most importantly, IPC$. ...
    (comp.security.firewalls)
  • Re: Admin$ and IPC$ shares disappear repeatedly
    ... Administrative shares then being listed as IPC$, ADMIN$, or C$. ... Mapping to network drives works, IF you do not specify a domain ... And when I manually create them via "net share IPC$" or "net share ADMIN$" ...
    (microsoft.public.win2000.general)
  • Re: administrative shares
    ... >> None of the administrative shares are present. ... the ipc$ share appears in the ... >> two and file sharing no longer works afterwards. ... >Please explain this command as I am getting system errors. ...
    (microsoft.public.win2000.networking)
  • Re: administrative shares
    ... > None of the administrative shares are present. ... enables the ipc$ share ("ipc$ was shared ... > two and file sharing no longer works afterwards. ...
    (microsoft.public.win2000.networking)