Remove or not to remove default shares, that is the question

[jmconsulting]

Greetings all.....

Maybe I was misled back in the early days of the NT server, but I was under the impression that you should always remove all default shares (C$, D$, etc) prior to allowing anyone to connect to the domain (or shortly there afterwords). I just heard of a situation (not sure off all the details) but where some app was attempting to be installed and they were uable to do so because the defaults have been removed.

Although I have not run into any occurance of the happening myself, I was just curious of anyones input on the subject of "to remove or not" the default shares.

PS....I am building a new server as we speak and just curious on anyone's expertise.

 

[ncotton]

Would this happen to have anything to do with a post on here, in the SMS Forum?

Hope this Helps.

Neil J Cotton
njc Information Systems
Systems Consultant

 

[58sniper]

I would imagine some remotely deployed apps wouldn't work.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[jmconsulting]

ncotton...no not directly. I did not read that post but I will look it up and follow it thru.

Just curious on what exposure (pros and con) there might be if one was to leave the default shares on the system as opposed to removing them completely.

58sniper...that is what I have heard thru the grapevine as well. Just curious on everyones experience on the matter.

thanks.....Jim

 

[PScottC]

If you look at some of the Auditing tools out there like GFI LanGuard, this comes up as a low risk vulnerability. To compromise a system on one of these shares, the attacker would have to have acquired local admin privilege on the system. Once that's happened, I don't think the share really matters any more, does it?

Honestly, I can't say that I'd recommend removing it at this point.

PSC

Governments and corporations need people like you and me. We are samurai. The keyboard cowboys. And all those other people out there who have no idea what's going on are the cattle. Mooo! --Mr. The Plague, from the movie "Hackers

 

[markdmac]

I would not recommend the removal of the default shares. I can't tell you how often as an admin I have had to use them.

To gain access to these shares would require physical access to the network or VPN access AND would require the user to have admin rights. If they have met those criteria, you tell me what they CAN'T do on your network.

I hope you find this post helpful.

Regards,

Mark

 

[jmconsulting]

Thanks for the info. I agree and will not remove them.