Re: Defualt C$ Share

From: Robert Moir (robspamtrap+msnews_at_gmail.com)
Date: 06/30/05 

Date: Thu, 30 Jun 2005 10:52:23 +0100

Doug Knox MS-MVP wrote:
> So much for A+ certifications. This is not true. The $ indicates an
> Administrative share, and they are created by default on all Windows
> 2000/XP machines. Any user with the Administrator credentials on the
> machine can access these shares.

Minor point Doug, a "$" at the end of a share name indicates a *hidden*
share, one that doesn't show up when browsing a computer. Other than that,
hidden shares can behave like a normal share in any other way.

While the set (administrative shares) is a member of the set (hidden
shares), the reverse is not true - you can create your own hidden share by
sharing anything you like, setting NTFS and share permissions any way you
like (including removing access rights from admins), and placing a "$" at
the end of the share name. 

-- 
-- 
Rob Moir
Website - http://www.robertmoir.co.uk
Virtual PC 2004 FAQ - http://www.robertmoir.co.uk/win/VirtualPC2004FAQ.html
Kazaa - Software update services for your Viruses and Spyware.

Relevant Pages

  • Re: Default Shares
    ... I would not worry too much about disabling the default shares if they are ... administrator account to logon to any domain computer that is not known to ... local administrators group of domain computers which can be easily managed ...
    (microsoft.public.win2000.security)
  • Re: Unable to turn off sharing
    ... > Hidden shares are created by default, ... > level users on the system and are typically used for remote management ... administrator privileges have access to them. ...
    (microsoft.public.security)
  • Re: Viewability of shared folders ?
    ... someone knows your administrator password then it can access your system any ... You can also protect the computer by using personal or dedicated firewall to ... it is possible to remote these shares by editing registry. ... > drives... ...
    (microsoft.public.win2000.security)
  • Re: Unable to turn off sharing
    ... >> Hidden shares are created by default, ... >> administrator level users on the system and are typically used for remote ... > To add to what Jason has advised, I would leave them where they are. ... > administrator privileges have access to them. ...
    (microsoft.public.security)
  • Re: Deny rights question
    ... I have checked the shares and they are set to "Authenticated Users". ... there is the "Administrator" account assigned to ... >> Being local administrator on local Windows XP computers doesn't give ... >> administrative permissions on any other computer in domain. ...
    (microsoft.public.windows.server.general)