Re: Prevent Sharing drives on clients

I don't mind the C$ and Admin$ shares because they are accessible for
Administrators of the computer. I just want to prevent them from sharing
C:\ to the Everyone group. Is there a policy prevent sharing of folders on
computers in the domain without killing of th C$ and Admin$ shares?

"Dave Britt" <davebritt@xxxxxxxxxxx> wrote in message
news:uFEVIQulGHA.3576@xxxxxxxxxxxxxxxxxxxxxxx
Jordan,

You could use this script to temporarily remove the C$ share from the
machine, this would then be gone until the next reboot of the machine.
This would be re-enabled because of the autoshares reg key that generates
Admin Shares, which you cannot remove because you want to maintain the
Admin$ share.

Script:
-------------------
strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")

Set colShares = objWMIService.ExecQuery _
("Select * from Win32_Share Where Name = 'C$'")

For Each objShare in colShares
objShare.Delete
Next
--------------------

The problem is that what ever you configure through Group Policy a user
with Local Administrator rights can remove if they have the knowledge and
will to do so.

--
Dave Britt

Dave's Weblog
http://davebritt.blogspot.com


"Jordan" <none@xxxxxxxx> wrote in message
news:%239tbsmglGHA.1972@xxxxxxxxxxxxxxxxxxxxxxx
I have a couple of users that need to be administrators on their local
computer (developing hardware and software). They keep sharing their hard
drive so they can access it from other computers which is a big no-no
here. Is there a GP that prevents creating new file shares but leaves the
Admin$ share for remote management programs?





.

Relevant Pages

  • Re: Looking for a VB Script to set share permissions
    ... but for some security considerations, all ?$ shares are removed, and I think ... it is more safe to allow administrators only to read. ... > Of course it works, I didn't say it would not work, I just said sharing ...
    (microsoft.public.windowsxp.security_admin)
  • Need tweak to prohibit creation of new shares
    ... Admin, of course) from creating any new shares (eg. sharing ... a personal folder)? ...
    (microsoft.public.win2000.security)
  • Re: DC Admin question
    ... If someone needed to manage file shares, I would say, there are these X ... I would prefer no printers on DCs nor even queues, ... enhanced rights to is for some, likely good, reason. ... solutions to the unacceptible obvious one of giving admin. ...
    (microsoft.public.windows.server.security)
  • Re: New Organizational Unit for a new remote office.
    ... This posting is provided "AS IS" with no warranties, and confers no rights. ... BLOG --> http://blogs.dirteam.com/blogs/jorge/default.aspx ... EVERY DOMAIN ADMIN IN THE FOREST ...
    (microsoft.public.win2000.active_directory)
  • Re: Rid AD of Circular Group Membership
    ... I'll try to keep this going; because it might be useful to another admin ... The quess is each has an account and uses it, ... part of stations) into the machine local Administrators group. ... Administrators Group has a members: ...
    (microsoft.public.windows.group_policy)