Sole's Blog

Large companies sometimes have problems with a virus that realy loves administrative shares on other workstations (i.e. c$ and admin$), it will try and break into theese to spread it self directly. The easy option ofcourse being kill the virus or even better harden administrative users and not use administrator rights for normal users! But untill that is an easy, non-political and not so time consuming task, why not disable the administrative shares on the workstations alltogether?

Seems like a perfect thing to do with Group Policy, unfortunately the setting is non-existing default in Group Policies, so by finding the registry key we need to change, a small custom administrative template will do the trick. This could also be used for other registry changes needed with group policy.

We might also want the option to easily enable the administrative shares later, might be used by applications, services, automated installations, etc. Heres is how to do it quick and easy.

Create a file named adminshares.adm with the content from below, under C:\windows\inf on the server You edit your GPO’s with.

CLASS MACHINE
CATEGORY !!category1
CATEGORY !!category2
POLICY !!policyname
EXPLAIN !!DefaultSharesExplain
KEYNAME "System\CurrentControlSet\Services\LanManServer\Parameters\"
VALUENAME "AutoShareWks"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY
END CATEGORY
END CATEGORY
[strings]
category1="Network"
category2="Sharing"
policyname="AdministrativeShares"
DefaultSharesExplain="Enables default workstation administrative shares if enabled or disables if disabled"

You can also download the above adm policy as a text file here. (right click save as)

Create a new GPO and right click on administrative templates, add administrative template you just created.

Click machine administrative templates, go into view filtering, unselect/uncheck “Only show policy settings that can be fully managed” the setting is shown in the top picture. Basicly this allows the GPO Editor to show settings, that is not within the default area of registry “preferences” – like ours. Any settings done outside “preferences” will persist if the policy is removed, unlike standard policies.

Open Administrative templates – Network – Sharing

Enable or disable administrative shares.

Done. Might be possible to do this easier, but my google results havent found it 🙂 feel free to add information.

14 Responses to “How to disable administrative shares on workstations thru Group Policy and avoid spending time on pesty virus infections”