How the Administrative Share in Windows NT/2000/XP/2003 can be disabled?
Every Windows NT/2000/XP/2003 machine automatically creates a share for each drive on the system. These shares are hidden, but available with full control to domain administrators. The drive letter, followed by the $ sign is the name, and it is shared from the root.
When trying to attain a highly secure network, you may wish to address this potential security issue by disabling these shares, or at least restricting their permissions to specific users or services.
The default-hidden shares are:
*C$ D$ E$ - Root of each partition. For a Windows NT workstation/2000/2003/XP Professional computer only members of the Administrators or Backup Operators group can connect to these shared folders. For a Windows NT Server/2000 Server computer, members of the Server Operators group can also connect to these shared folders.
*ADMIN$ - %SYSTEMROOT% This share is used by the system during any remote administration of a computer. The path of this resource is always the path to the 2000/NT system root (the directory in which 2000/NT is installed usually C:\Winnt and in XP it's C:\Windows).
*FAX$ - On 2000 Server, this used by fax clients in the process of sending a fax. The shared folder temporarily caches files and accesses cover pages stored on the server.
*IPC$ - Temporary connections between servers using named pipes essential for communication between programs. It is used during remote administration of a computer and when viewing a computer's shared resources. This share can be very dangerous and can be used to extract large amounts of information about your network, even by an anonymous account.
*NetLogon - This share is used by the Net Logon service of a 2000, 2003 and NT Server computer while processing domain logon requests, and by Pre-2000 computers when running logon scripts.
*PRINT$ - %SYSTEMROOT%\SYSTEM32\SPOOL\DRIVERS Used during remote administration of printers.
It is possible to simply remove the share from Server Manager (in NT) or Shared Folders (in 2000/XP/2003) but the problem with this method is that the shares will automatically be recreated when the machine reboots.
You can disable the automatic administrative share creation via Group Policy, but this is a much simpler way is also available:
In order to disable these shares permanently, a registry edit will be necessary.
Security note:
Unfortunately this registry hack does NOT stop the IPC$ share and this is a share that is often used by hackers to enumerate systems before attack since it can yield a wealth of information about your system names, your user names, and more. If your ACL permissions are not correct or you haven't disabled anonymous user access or you haven't disabled the guest account then this port can lead to total system compromise within minutes!
Servers:
For NT 4.0/2000/Windows Server 2003s, the change is:
Hive: HKEY_LOCAL_MACHINE Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer
Data Type: REG_DWORD
Value: 0
If you can't find the value in the registry under the exact location (i.e. it does not exist) - please right click in the right pane of the window and create it.
Note: A reboot is necessary for this to take effect.
Workstations:
For NT 4.0 Workstation/2000 Pro/XP Pro, the change is:
Hive: HKEY_LOCAL_MACHINE Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0
If you can't find the value in the registry under the exact location (i.e. it does not exist) - please right click in the right pane of the window and create it.
Note: Again, a reboot is necessary for this to take effect.
If you want the administrative shares to be re-created, you can change the value back to 1.
Note: Some applications depend on the presence of these shares. If things stop working you'll know to re-enable the shares.
Showing posts with label Remote Access. Show all posts
Showing posts with label Remote Access. Show all posts
Friday, December 11, 2009
How to Disable/Restrict Remote Registry Access in Windows
How to Disable/Restrict Remote Registry Access in Windows
Windows 2000, Windows XP and Windows 2003 supports Remote Registry access using Remote Registry service. This allows a remote user or a remote administrator to connect to the PC or server systems registry remotely and view or modify it.
This is ideally a feature for Remote Administrator or Management Applications to efficiently manage systems without having to manally logging onto the system, but on the other hand this can be a potential security risk.
Hence, if this service is not used for any management purpose then needs to be disabled.
To disable the service,
1. Click Start – RUN and type “services.msc”
2. In the right-pane, right-click “Remote Registry” and select Propertes.
3. Select Startup type as “Disabled” and click “stop” if the service is running.
4. Click Apply and OK.
The above mentioned steps are needed, if there is no need for anyone to connect and modify the Windows Registry remotely. However, if this PC or a system is a part of a corporate network and is part of Active Directory domain then select list of admins or admin groups might need permission to control the registry. In this case, the alternate option to selectively restrict access to the registry remotely the following procedure will be of help to you:
1. Click Start – RUN.
2. Type “regedit” and press enter. This will open the Windows Registry Editor.
3. Navigate to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\
4. Select “winreg” and click Edit, Select “Permissions”
5. Select appropriate users/groups & appropriate permission like “Read” or “full Control”.
6. Click OK and exit.
This should restrict Remote Registry access on your Windows Server or PC.
Windows 2000, Windows XP and Windows 2003 supports Remote Registry access using Remote Registry service. This allows a remote user or a remote administrator to connect to the PC or server systems registry remotely and view or modify it.
This is ideally a feature for Remote Administrator or Management Applications to efficiently manage systems without having to manally logging onto the system, but on the other hand this can be a potential security risk.
Hence, if this service is not used for any management purpose then needs to be disabled.
To disable the service,
1. Click Start – RUN and type “services.msc”
2. In the right-pane, right-click “Remote Registry” and select Propertes.
3. Select Startup type as “Disabled” and click “stop” if the service is running.
4. Click Apply and OK.
The above mentioned steps are needed, if there is no need for anyone to connect and modify the Windows Registry remotely. However, if this PC or a system is a part of a corporate network and is part of Active Directory domain then select list of admins or admin groups might need permission to control the registry. In this case, the alternate option to selectively restrict access to the registry remotely the following procedure will be of help to you:
1. Click Start – RUN.
2. Type “regedit” and press enter. This will open the Windows Registry Editor.
3. Navigate to
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SecurePipeServers\
4. Select “winreg” and click Edit, Select “Permissions”
5. Select appropriate users/groups & appropriate permission like “Read” or “full Control”.
6. Click OK and exit.
This should restrict Remote Registry access on your Windows Server or PC.
Subscribe to:
Posts (Atom)