Quickie about disabling administrative shares

[Gompedyret]

Hiyall,

Just setting up my final nlited XP pro, and came across a choice of disabling administrative shares. After spending one hour++ searching, the definitive answer keeps eluding me, so I'll ask instead:

My PC is on a private workgroup LAN with two other pcs (all three xp pro) and one mac. Will disabling administrative shares affect file sharing? Simple file sharing, that is.

If the answer is no, shedding this feature would just make me feel better, as I see no reason to have them there (I conduct no fancypants networking). Guess you could say that I should ask this primarily for security, but then again, if so we wouldn't use simple file sharing?

Anyway, be glad if anyone more knowledgeable could provide a simple yes or no here.

(edit: added question mark smiley and corrected some language)

Edited September 4, 2007 by Gompedyret

[nmX.Memnoch]

If you're on a private LAN I see no reason to worry about disabling them at all. Only Administrators have access to the admin shares--hence the name "administrative shares"--and this access level can't be changed.

To answer your other question...no, it won't affect simple file sharing (or any other sharing) in the least. The admin shares are simply default shares that point to the root of each drive and the Windows directory:

Admin$ = %SYSTEMROOT% (normally C:\WINDOWS\)

C$ = C:\

D$ = D:\

E$ = E:\

And so on. Those shares are also required for tools such as SMS, remote scanning with MBSA or centralized AntiVirus management. You're probably not using those so that's not a concern...but again, I see to reason to worry about disabling them.

[Gompedyret]

Thanks! Also for answering, also my half implied question.

But alas, I forgot to mention that yes, we share an internet access as well, through a (firewalled) adsl router. So that's where the security issue will rise. Sorry about that.

As for those things you mentioned which administrative shares will be used, you just confirmed my impression. PC administration is exclusively done on and from this pc, so the only network service (except internet access) needed will be simple file sharing of some music, images and the usual stuff.

[nmX.Memnoch]

But alas, I forgot to mention that yes, we share an internet access as well, through a (firewalled) adsl router. So that's where the security issue will rise. Sorry about that.

Your PC's are behind a router. That means they're using Network Address Translation. Unless you open/forward the correct ports on the router to an internal PC (or put a machine in the DMZ), no one from the outside will be able to get to your PC's.

Honestly, IF someone got through I'd be more worried about the open shares from Simple File Sharing than I would about the default admin shares.

Edited September 4, 2007 by nmX.Memnoch

[Gompedyret]

Thank you for your time, I appreciate it.

You gave the answer i suspected. That's settled then, I'll just leave it be and direct my compulsive drive to remove anything that might not be needed to more important issues.

Cheers!

[gosh]

Let me add my 2 cents:

Admin shares are hidden by default on windows computers, very simply windows is hard coded to hide them from view. However on non-windows based pc's you can see the default shares (c$,d$...). Since you mentioned you have a mac, im curious if you can see the admin shares on the mac?

Overall i would recommend keeping the admin shares because they are so useful. You would be better off removing telnet and DDE shares.

-gosh

[Gompedyret]

Since you mentioned you have a mac, im curious if you can see the admin shares on the mac?

I'll check this out, hopefully tomorrow.

[Stoic Joker]

Part of the "Simple" in Simple File Sharing is that the Hidden Administrative shares aren't available when it's enabled. e.g. you must disable Simple File Sharing to expose and use the "default" hidden administrative shares.

So if you (have enabled and) are using Simple File Sharing, then you have no hidden shares to worry about blocking/hiding/securing.

[Gompedyret]

Let me add my 2 cents:

Admin shares are hidden by default on windows computers, very simply windows is hard coded to hide them from view. However on non-windows based pc's you can see the default shares (c$,d$...). Since you mentioned you have a mac, im curious if you can see the admin shares on the mac?

-gosh

I've now checked this with the owner of the local mac (it belongs to a friend of mine, see). Running OSX 10.4.9, the administrative shares are NOT visible in that machine, neither my pc nor any of the other pc's on the lan. According to my friend the system has default settings as well.