Re: Accessing C$

From: Drew Cooper [MSFT] (dcoop_at_online.microsoft.com)
Date: 03/22/04 

Date: Mon, 22 Mar 2004 15:44:31 -0800

You're talking about XP? Shares don't have passwords. Any account with a
blank password is denied remote access. I doubt this change will be
backported to Win2k or NT unless they have a "security release" like XP is
getting with SP2, but I'm not directly involved with that team, so I can't
say for certain. 

-- 
Drew Cooper [MSFT]
This posting is provided "AS IS" with no warranties, and confers no rights.
"cquirke (MVP Win9x)" <cquirkenews@nospam.mvps.org> wrote in message
news:0n5r50t8ogceqm2khovggist55s7sm6ufb@4ax.com...
> On Tue, 16 Mar 2004 22:14:59 -0500, "Colin Nash [MVP]"
>
> About hidden c$ admin share...
>
> >Also, if the password for "Administrator" is blank it will, by default,
> >block access regardless of anything else.  XP has a setting that does not
> >allow accounts with blank passwords to gain access over the network.
This
> >is new and was not in NT or 2000.
>
> That's great news for XP users!  I guess it's Darwin take the hindmost
> for Win2000 or NT tho, unless there's a patch that retrofits this?
>
> Almost all my clients are standalones or small peer-to-peer where all
> who have physical access are trusted equallity.  They want:
>   - no remote access rights whatsoever
>   - unfettered local access by all users
>   - one user profile per PC
>
> They also expect data to be recoverable from sick or bonked HDs, and
> that pre-payload active malware can be cleaned up without barfing the
> system.  Those standard Win9x expectations can be delivered on FATxx.
>
> So my approach has been:
>   - 1 user account per PC, with full rights
>   - FATxx file systems throughout
>   - simple file sharing
>   - no admin password (at Safe Mode or RC level)
>   - account pwd that's auto-logged on (TweakUI) as needed for Tasks
>   - highly selective shares that exclude C:\ and OS subdir
>   - further patches, risk management, goalies of last resort (av)
>   - firewall if possible (tricky when forced to F&PS on TCP/IP)
>
> In this situation: Would c$ have blank password and be blocked, or
> (because the sole user account is Admin rights) use the account's pwd?
> As it is, I've taken to applying a .REG to kill these admin shares, as
> they look like 100% risk, 0% benefit to me in the contexts I describe.
>
> When, and only when, I have some users needing to do things other
> users shouldn't be allowed to do, do I switch to the "turn it on but
> hide it under a password" approach.  Also, only then do I find clients
> actually start listening when I describe user/pwd-based security; for
> the first time, it sounds like something they actually *want*    :-)
>
>
>
> >-------------------- ----- ---- --- -- - -  -   -
>   Running Windows-based av to kill active malware is like striking
>   a match to see if what you are standing in is water or petrol.
> >-------------------- ----- ---- --- -- - -  -   -

Relevant Pages

  • Re: Windows 2003 Users vs Software
    ... You need to have both an admin and a limited account ... >> as a limited user, to effect, "the software has not been installed ... The users do not have rights to install programs. ...
    (microsoft.public.security)
  • Re: Reboot command no longer works in Task Scheduler
    ... User rights assignment are set with a GPO located under Computer configuration, windows settings, security settings,local policies. ... Check there if the account, even the domain admin has the needed rights. ...
    (microsoft.public.win2000.general)
  • Re: Lost admin access to ADAM
    ... Firewall may be doing harm here. ... SDE, DS Admin eXperience ... This posting is provided "AS IS" with no warranties, and confers no rights. ... User account: NETWORK SERVICE ...
    (microsoft.public.windows.server.active_directory)
  • Re: Lost admin access to ADAM
    ... admins) as ADAM admin principal, as opposed to a specific user. ... use your domain account to connect (provided this account is a member of ... This posting is provided "AS IS" with no warranties, and confers no rights. ... If I install with my account (which has has local ...
    (microsoft.public.windows.server.active_directory)
  • Re: Lost admin access to ADAM
    ... User account: NETWORK SERVICE ... admins) as ADAM admin principal, as opposed to a specific user. ... This posting is provided "AS IS" with no warranties, and confers no rights. ... If I install with my account (which has has local ...
    (microsoft.public.windows.server.active_directory)