unknown admin share R$

[JGALEY]

I have a server that has an admin share R$ listed under Computer Management --> Shared Folders --> Shares. There is no R drive on the server, I cannot do a \\servername\R$ to see the share either from the local server or a remote machine, the path to the share is "unknown."

I can remove the share, but it always reappears after a restart. At some point in the past the server was promoted to a DC, then demoted. I understand the demotion may not have been very clean, but I do not have the details.

Are there any ideas out there as to what this share might be, why it is appearing, and how I can stop it (unless it is needed for some reason, but none of my other servers have this share)?

Thanks,

Jason

Jason

http://www.catotek.com

 

[JGALEY]

I know its a strange problem - not something I have seen before. How would I even begin to troubleshoot this? There is no R drive, and I do not see anything in the event viewer logs.

Any help out there? Should I be searching the registry for "R$"?

Jason

http://www.catotek.com

 

[porkchopexpress]

I'm just guessing here but what if you set this to stop the admin share from being created at startup then re enable it and see if the R$ comes back.


HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters and set AutoSharServer=0

http://www.jsifaq.com/SUBA/tip0000/rh0096.htm

 

[JGALEY]

My client was thinking about setting the key to false as you suggest and leaving it that way, but if I remember correctly, not having admin shares at all can lead to other problems. Maybe I will suggest that he do it temporarily like you are saying...

Thanks!


Jason

http://www.catotek.com