Re: What Are These Shares(Remote Admin/Remote IPC)?

[Ansgar -59cobalt- Wiechers <bugtraq () planetcobalt net>]

On 2004-03-28 Mark Sargent wrote:
> are these neccessary..? I don't do any remote administration on/to
> this host (Win2kPro).

I suppose you are referring to the ADMIN$ and IPC$ shares. If you don't
do remote administration, then you most likely won't need them. You can
disable them (except for IPC$ IIRC) by editing a registry value:

----8<----
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters]
"AutoShareWks"=dword:0x00000000


---->8----

See [1] for details.

> I'm on an ADSL LAN with my sharemate. Don't suspect anything foul from
> him. I do have shared folders (for when connecting this host(laptop)
> to my desktop). Is that why I see these shares in Computer Management/
> System Tools/Shared Folders/Shares..?

No. These shares are automatically created by Windows for administrative
purposes.

[1] http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314984

Regards
Ansgar Wiechers

---------------------------------------------------------------------------
Ethical Hacking at the InfoSec Institute. Mention this ad and get $545 off 
any course! All of our class sizes are guaranteed to be 10 students or less 
to facilitate one-on-one interaction with one of our expert instructors. 
Attend a course taught by an expert instructor with years of in-the-field 
pen testing experience in our state of the art hacking lab. Master the skills 
of an Ethical Hacker to better assess the security of your organization. 
Visit us at: 
http://www.infosecinstitute.com/courses/ethical_hacking_training.html
----------------------------------------------------------------------------