Administrative shares are hidden network shares created by Windows NT family of
operating systems that allow system administrators to have remote access to
every disk volume on a network-connected system. These shares may not be
permanently deleted but may be disabled. Administrative shares cannot be accessed
by users without administrative privileges. Windows XP and later further
curtail the use of these shares. Share names
Administrative shares are a collection of automatically shared resources
including the following: Disk volumes: Every disk volume on the
system is shared as an administrative share. The name of these shares consists
of the drive letters of shared volume plus a dollar sign. For example, a
system that has volumes C, D and E has three administrative shares named C$, D$
or E$. OS folder: The folder in which Windows
is installed is shared as admin$ Fax cache: The folder in which faxed
pages and cover pages are cached is shared as fax$
IPC shares: This area, which is used for inter-process communication via named
pipes and is not part of the file system, is shared as ipc$
Printers folder: This virtual folder, which contains object that represent
installed printers is shared as print$ Domain controller shares: Windows Server
family of operating system creates two domain controller-specific shares called
sysvol and netlogon which do not have dollar signs appended to their names.
Characteristics Administrative shares have the following
characteristics: Hidden: The "$" appended to the end of
the share name means that it is a hidden share. Windows will not list such shares
among those it defines in typical queries by remote clients to obtain the
list of shares. One needs to know the name of an administrative share in order
to access it. Not every hidden share is administrative share; in other words,
ordinary hidden shares may be created at user's discretion.
Automatically created: Administrative shares are created by Windows, not a
network administrator. If deleted, they will be automatically recreated.
Administrative shares are not created by Windows XP Home Edition.
Management The administrative shares can be deleted
just as any other network share, only to be recreated automatically at the next
reboot. It is, however, possible to disable administrative shares.
Disabling administrative shares is not without caveats. Previous Versions for
local files, a feature of Windows Vista and Windows 7, requires administrative
shares to operate. Restrictions
Windows XP implements "simple file sharing", a feature that can be enabled
on computers that are not part of a Windows domain. When enabled, it
authenticates all incoming access requests to network shares as "Guest", a
user account with very limited access rights in Windows. This effectively
disables access to administrative shares.
By default, Windows Vista and later use User Account Control to enforce
security. One of UAC features denies administrative rights to a user who
access network shares on the local computer over a network, unless the
accessing user is registered on a Windows domain or using the built in
Administrator account. It is possible to disable UAC remote restrictions.
See also Server Message Block – the
infrastructure responsible for file and printer sharing in Windows
Distributed File System – another infrastructure that makes file sharing
possible My Network Places – Windows graphical
user interface for accessing network shares
Network Access Protection – a Microsoft network security technology
Conficker – an infamous malware that exploited a combination of weak
passwords, security vulnerabilities, administrative negligence and admin$
share to breach a computer over a network and propagate itself
References