C$

[Guntha]

I am going to sound pretty stupid here but I need to know the answer to this. Why is it that I can map a drive to any LAN connected PC's C$ running 2K pro and access everything on it? Even locked down files? I just tested it on a few PC's and while I was doing this a person that I would rather not know about this saw it and now I fear for security. CAn anyone tell me how to lock this down? I tried to assign permissions on the default C share but Windows said it cannot be configured? Thanks!!


G

 

[TonHu]

A bold solution: Just remove the C$ share?

You must have logged on with administrator privileges when accessing that share. Lock down the user rights for that user to less than guest, and/or remove him from the Everyone group. If administrator has no password, or your users are administrator/poweruser equivalent, then you know who's fault that was... s-)

HTH
TonHu

 

[Guntha]

I though of that but, it comes back up after each reboot, managed by windows I guess. Most of my Network Users have been given Power user rights for a specific business app that would not run without it. Damn this could get ugly...Anymore advice?

G

 

[jgoodman00]

I though of that but, it comes back up after each reboot, managed by windows I guess.

What do you mean by this?
Are you saying the share is mapped to a drive on startup, & no matter who logs in, this share is re-mapped at logon?

If so, is it possible their user profiles were created from the Admin profile, which had the C$ mapped to it?

If they are not assigned admin rights though, they should not be able to access the share...


To the best of my knowledge you cannot remove the C$ as it is used by windows...
James Goodman MCP

http://www.james-goodman.co.uk

 

[wolluf]

Agree with James - no admin access, no access to C$.

C$ can be removed with the help of a registry tweak (

http://www.jsifaq.com/SUBA/tip0000/rh0096.htm),

otherwise its recreated every time you restart.

 

[meacham]

The c partition has to be shared for "administrative purpossees". MY solution would, to remove some of the permissions (NOT share rights). I'm assuming here, that you are running on NTFS...

Let us/me know if any of this helps