Disable Administrative Shares

The administrative shares can be deleted by a user with Administrators membership but the administrative shares will be recreated automatically at the next reboot.

The following registry configuration change e.g. using Regedit can completely hide all administrative shares. If the setting is not present then you must create it.

Servers

Windows NT 4.0 Server, Windows 2000 Server, Windows Server 2003

Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareServer
Data Type: REG_DWORD
Value: 0

Clients

Windows NT 4.0 Workstation, Windows 2000 Professional, Windows XP

Hive: HKEY_LOCAL_MACHINE
Key: SYSTEM\CurrentControlSet\Services\LanManServer\Parameters
Name: AutoShareWks
Data Type: REG_DWORD
Value: 0

How to disable

Microsoft does not detail any method to disable administrative shares. The command:

NET SHARE C$ /delete

Can be executed in order to disable the root share in a networked computer. The problem is that after a reboot, the share will be automatically recreated.

A common workaround is to create a batch file with commands to disable all administrative shares (they can be viewed by running the "NET SHARE" command), and then scheduling the script to run at every system startup by using the Windows Task Scheduler.

Usually, the following commands, under a batch file, can successfully disable shares on a Windows XP or Windows Vista system:
NET SHARE C$ /delete
NET SHARE D$ /delete
NET SHARE admin$ /delete

Preventing access

Disabling the Administrative shares mitigates many known security
risks. For example, viruses such as Conficker Worm performs dictionary attacks on Administrative shares.

Alternative approaches to prevent remote browsing of the disk contents include:

* Remove "Administrators" from the Security tab of the drive in question. This will prevent any external local admin from accessing the drive yet still allow the local admin access
* disable File and Printer Sharing (or unbind the NetBT protocol)
* Stop and/or disable the Workstation service
* set IPSec block rules that prevent inbound connections on 445/tcp and 445/udp
* remove membership in the Administrators group for those users/groups you wish to block
* encrypt the files that must remain confidential using a file-based encryption technology (such as EFS or RMS) that requires access to per-user decryption keys to gain access to plaintext contents of the files

Quick .msc Shortcuts

Start > Run >

Certificates – certmgr.msc

Indexing Service – ciadv.msc

Computer Management – compmgmt.msc

Device Manager – devmgmt.msc

Disk Defragmenter – dfrg.msc

Disk Management – diskmgmt.msc

Event Viewer – eventvwr.msc

Shared Folders – fsmgmt.msc

Local Users and Groups – lusrmgr.msc

Removable Storage – ntmsmgr.msc

Removable Store Operator Requests – ntmsoprq.msc

Performance – perfmon.msc

Services – services.msc

Windows Management Infrastructure (WMI) – wmimgmt.msc

source : My Tech World