Administrative shares

Every NT based Windows system (NT/W2K/XP/2003) automatically creates a network share of every hard drive. These shares will allow anyone with the administrator password access to the root of every hard drive on a system. Unless you are in an enterprise environment you will probably not want these enabled. A recently released vunerability in SP2 gives even more concern. Read here: http://www.pcwelt.de/know-how/extras/103039/

Share Names

These shares are the drive letter name with a "$" at the end.

For example:

//NetworkComputerName/(Drive letter)$

In the real world it would look like this:

//mycomp/c$

That would be the share of the C drive. Substitute the drive letter and it will work with any drive on the machine.

There is also a share of the Windows folder.

//mycomp/ADMIN$

How to disable

You can delete the shares but they will just be renewed at the next startup. The easiest way correct this is through Regedit. If the entry is not there it has to be created.

Servers

NT 4.0/W2K/Windows Server 2003

   Hive: HKEY_LOCAL_MACHINE
   Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
   Name: AutoShareServer
   Data Type: REG_DWORD
   Value: 0

Regular Workstation

NT 4.0 Workstation/W2K Pro/XP

   Hive: HKEY_LOCAL_MACHINE
   Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
   Name: AutoShareWks
   Data Type: REG_DWORD
   Value: 0