AW: XP admin shares

[Paul.D.Jordan () aib ie]

Leon,

Standard Disclaimer about doing anything with the Registry: 

Modifying the registry can cause serious problems that may require you to 
reinstall 
your operating system. We cannot guarantee that problems resulting from 
modifications 
to the registry can be solved. Use the information provided at your own 
risk. 

All that having being said -

Instructions below adapted from those at 
http://online.securityfocus.com/archive/105/297174/2002-10-25/2002-10-31/2

The Registry Guide referred to in the original post in the Security Focus 
Archive
is available from http://www.winguides.com/

1. Open your registry using Registry Editor (Start - Run - Regedit.exe - 
Enter) and find: 

HKEY_Local_Machine\System\CurrentControlSet\Services\LanmanServer\Parameters

2. Create a new DWORD value  ("Edit - New - Dword Value" in Regedit.exe) 
of either 
    a) 'AutoShareWks' for a Workstation or 
    b) 'AutoShareServer' for a server. 

3. Set the value to equal '0' to disable sharing. 
    If the values already exist then modify them to change the value.
    Value: (0 = disable shares, 1 = enable shares)

4. Restart Windows XP and the automatic shares should not be created.

Regards,
Paul

**********************************************************************
*Paul Jordan, IT Security Operations (ROI/UK)
*Allied Irish Banks
*E-mail: Paul.D.Jordan () aib ie
*Post: Block A1, AIB, Bankcentre, Dublin 4, Ireland
*Phone: +353-1-6413888 Ext 13872 Internet http://www.aib.ie 
* 
*This posting is strictly confidential and is intended 
*only for use by the addressee unless otherwise indicated. 
*Opinions expressed are solely those of the originator and 
*use of any material contained in the posting is entirely at 
*the user's risk. 
**********************************************************************




Leon Pholi <L.Pholi () secureinteractive com>
09/12/2002 12:27 AM

 
        To:     security-basics () securityfocus com
        cc: 
        Subject:        XP admin shares




Hi everyone,

Just a quick one, does anyone know how to stop the default administrative
file shares in Win XP (professional edition)? One would think this would 
be
a standard part of locking down a box, but can't find much on it for XP.

You can do it through Computer Management but they'll be re-enabled at
reboot, and the Win2k key of
HKLM\SYSTEM\CurrentControlSet\Services\LanManServer\Parameters\AutoShareWks
doesn't seem to exist. Any ideas?

Thanks,
Leon





**********************************************************************
This document is strictly confidential and is intended for use by
 the addressee unless otherwise indicated.

Allied Irish Banks
**********************************************************************