Re: Admin$ and IPC$ shares disappear repeatedly

From: NCKestrel (NCKestrel_at_discussions.microsoft.com)
Date: 11/29/04

  • Next message: Dave Patrick: "Re: Perfmon Process object not listed in Add Counters dialogue - W" 
    Date: Mon, 29 Nov 2004 13:19:15 -0800

    http://support.microsoft.com/default.aspx?scid=kb;en-us;842715
    "Overview of Problems that may occur when administrative shares are missing"
    Administrative shares then being listed as IPC$, ADMIN$, or C$.
    The article then mentions several of the problems I am having.
    1. No logon server is available to service the logon request when trying to
    map network drives.
    2. netdiag.exe failing to list DCs.
    All of the users are using cached credentials, except for logging on locally
    to the DC. Mapping to network drives works, IF you do not specify a domain
    and you are connecting to a network drive shared by the DC. (IE, it can look
    up logons itself).
    The DC is not showing any errors in Event Viewer that appear to have
    anything to do with this.
    I've done the registry edit listed to supposedly create the administrative
    shares on startup. They are not there by the time I log in to the server.
    And when I manually create them via "net share IPC$" or "net share ADMIN$"
    they only exist for seconds.
    I've also checked PoleEdit and SecEdit and both had the administrative
    shares turned on.

    "Pegasus (MVP)" wrote:

    >
    > "NCKestrel" <NCKestrel@discussions.microsoft.com> wrote in message
    > news:01F21539-0F13-4CDC-9EED-E0714AC00978@microsoft.com...
    > > Our sister company at a remote location has a single domain controller.
    > That
    > > one DC is now having a problem where the Admin$ and IPC$ shares disappear
    > > within seconds of creating them.
    > > IE. I can type "net share admin$"
    > > followed by "net share" and see admin$ listed. If I type "net share" fast
    > > enough. Within 10-15 seconds later, I can type net share again and the
    > > admin$ is no longer listed. The same happens with IPC$.
    > > The client stations are now getting an error when trying to get to shared
    > > network drives ("no logon server is currently available") and I can not
    > > promote another server to be a DC. If I type the "net share admin$" and
    > "net
    > > share IPC$" and have the dcpromo on the second server ready to go, I can
    > > sometimes get partway through starting the promotion before it loses the
    > > share again.
    > > This computer recently had files infected with W32.Spybot.Worm and
    > > Backdoor.Sdbot. However, it showed no (other) signs of the computer
    > itself
    > > being infected (none of the registry changes, etc listed for those
    > viruses).
    > > And the files were cleaned. One of the files it said was infected was
    > > "c:\win2000\system32\spool\drivers\svhost.exe". Others were two files in
    > the
    > > same dir (fwr.exe and msgfix.exe).
    > >
    > > I'd like to 1) get the admin$ and ipc$ shares to stick so that the users
    > can
    > > access the network again or 2) get another DC and trash this one without
    > > losing all the user accounts and other AD information. Any suggestions?
    > >
    >
    > I thought the default administrative shares were C$, D$ etc?
    >
    >
    >

  • Next message: Dave Patrick: "Re: Perfmon Process object not listed in Add Counters dialogue - W"

    Relevant Pages

    • Re: administrative shares
      ... >> None of the administrative shares are present. ... the ipc$ share appears in the ... >> two and file sharing no longer works afterwards. ... >Please explain this command as I am getting system errors. ...
      (microsoft.public.win2000.networking)
    • Re: A Hack Attack and IPC$
      ... On Sat, 09 Aug 2003 18:50:13 GMT, Lars M. Hansen ... >>most importantly, IPC$. ... >That'll disable all the admin shares. ... A setting of zero prevents the administrative shares, ...
      (comp.security.firewalls)
    • Re: administrative shares
      ... > None of the administrative shares are present. ... enables the ipc$ share ("ipc$ was shared ... > two and file sharing no longer works afterwards. ...
      (microsoft.public.win2000.networking)
    • Re: A Hack Attack and IPC$
      ... > during a session but is there a way to delete the share so it does not ... > On M$ systems there are administrative shares that are created ... Some of these admin shares include: ... > most importantly, IPC$. ...
      (comp.security.firewalls)
    • Re: Another hand for Microsoft - Clap Clap Clap
      ... Administrative shares can only be accessed by admins by design. ... >>> Windows ME has the option to set up a Network drive. ... Works fine when I log in using Windows ME with an admin ... I don't know if this is part of the domain controller ...
      (microsoft.public.windowsxp.general)
    • Quantcast