Re: Admin$ and IPC$ shares disappear repeatedly

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Steve Duff [MVP] (ergodic_at_ergodic-systems.com)
Date: 11/29/04 

Date: Mon, 29 Nov 2004 13:12:08 -0800

My guess is that you still have something. Try another scanner
with current signatures first, or something like the online
scanner at pandasoftware.com which I've found is very good.

After that, I think going directly to an install-mode repair is the
best choice. Do a system backup, put in the Server CD and
click "upgrade". This will rebuild the hardware tree, missing
or corrupt system registry values, corrupt files, security and rights
problems, etc. and may fix the issue.

Note if your CD is an older service pack from what you are using,
you will have to boot from the CD and take the >second< repair choice,
then you'll need to reapply service packs and updates as your server
will be back at that level after the "upgrade." Or you can slipstream
your own SP4 CD -- detailed information on doing this is all over
the Internet and it is not difficult to do.

Steve Duff, MCSE, MVP
Ergodic Systems, Inc.

"NCKestrel" <NCKestrel@discussions.microsoft.com> wrote in message news:01F21539-0F13-4CDC-9EED-E0714AC00978@microsoft.com...
> Our sister company at a remote location has a single domain controller. That
> one DC is now having a problem where the Admin$ and IPC$ shares disappear
> within seconds of creating them.
> IE. I can type "net share admin$"
> followed by "net share" and see admin$ listed. If I type "net share" fast
> enough. Within 10-15 seconds later, I can type net share again and the
> admin$ is no longer listed. The same happens with IPC$.
> The client stations are now getting an error when trying to get to shared
> network drives ("no logon server is currently available") and I can not
> promote another server to be a DC. If I type the "net share admin$" and "net
> share IPC$" and have the dcpromo on the second server ready to go, I can
> sometimes get partway through starting the promotion before it loses the
> share again.
> This computer recently had files infected with W32.Spybot.Worm and
> Backdoor.Sdbot. However, it showed no (other) signs of the computer itself
> being infected (none of the registry changes, etc listed for those viruses).
> And the files were cleaned. One of the files it said was infected was
> "c:\win2000\system32\spool\drivers\svhost.exe". Others were two files in the
> same dir (fwr.exe and msgfix.exe).
>
> I'd like to 1) get the admin$ and ipc$ shares to stick so that the users can
> access the network again or 2) get another DC and trash this one without
> losing all the user accounts and other AD information. Any suggestions?
>

Relevant Pages

  • A Hack Attack and IPC$
    ... I know there is a way to delete the IPC$ share ... Some of these admin shares include: ... The hackers had copied a few files to the server: ... the IPC$ share re-creates on server reboots this could be a problem. ...
    (comp.security.firewalls)
  • Admin$ and IPC$ shares disappear repeatedly
    ... one DC is now having a problem where the Admin$ and IPC$ shares disappear ... I can type "net share admin$" ... The same happens with IPC$. ... promote another server to be a DC. ...
    (microsoft.public.win2000.general)
  • Re: The server is not configured for transactions
    ... To follow up on what Michael said, you can see if the IPC$ share exists by ... uninstalling and reinstalling the File and Print Sharing network service. ... That should re-create and share out properly the IPC$ share. ... >> I am running it as a proxy server and a PDC. ...
    (comp.os.ms-windows.nt.admin.security)
  • Re: Passing MarshalByRef object to Remoted Server
    ... If I understand you, what you are trying to do it get the client to use IPC to talk to the server, which is using TCP? ...
    (microsoft.public.dotnet.framework.remoting)
  • Re: Server not configured for transactions
    ... Use "net share" command on the shared computer to check share status. ... there is not a share named "IPC$" in the share list, ... Make sure WINS and DNS are running on the server. ... > back to the Microsoft Windows Network folder looking at ...
    (microsoft.public.win2000.setup_deployment)