Friday 19 July 2013

Finding out if your Windows operating system created administrative shares


1.    Right-click on My Computer on the desktop and select Manage
2.    After the Computer Management console loads, expand Shared Folders
3.    Select Shares

4.    Look at the right side and see if your partitions are shared. It is easy to spot because it will look something like C$ or D$ which is dependent on your computer’s drive letters

If you find one or all of your partitions there, then you’ve got administrative shares. You should seriously consider disabling it to secure your computer.
Loading the Registry Editor

The best way to do this is to change a value in the registry. Follow the steps below to load the Registry Editor.

1.    Press the Start button
2.    Select Run
3.    Type Regedit in the dialog box
4.    Select Ok and the Registry Editor loads afterwards


Disabling administrative shares
In this task, we need to go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanManServer
\Parameters

To get there, please follow the steps below.

1.             Expand HKEY_LOCAL_MACHINE
2.             Expand System
3.             Expand CurrentControlSet
4.             Expand Services
5.             Expand LanManServer
6.             Select Parameters
7.             Look for the REG_DWORD entry named AutoShareWks
8.             Double-click on it and change the value to 0



In case the entry AutoShareWks does not exist, do the following:

1.    Right-click on the right side of the editor
2.    Select New, then DWORD
3.    Type AutoShareWks as the name of the entry
4.    Check that the value is 0
5.    Close the editor
6.    Reboot the computer

After rebooting, go back to the Computer Management console and check the shares again. It should now look something like the picture below.

Your files are now safe from other network users.



0 comments:

Post a Comment