Main Area and Open Discussion > General Software Discussion

Using Windows 10 Administrative Shares

(1/3) > >>

wraith808:
Today, I needed to connect to the administrative share on my other box.  To my consternation, it didn't work, giving me an access denied message.  After a bit of searching, I came up with a link on TomsIT Pro.com on this very issue.

It's in the process of archiving on archive.is at http://archive.is/ox74W

Duplicated Below in plain text:

Using Windows 10 Administrative Shares
By Adam BertramMARCH 29, 2016 1:00 PM
     
In Windows 10, administrative shares work the same in domain environments. But when dealing with Windows 10 systems in a workgroup you'll have to use a workaround to get access to administrative Windows 10 shares—here's how.



The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros. Administrative file shares are the hidden shares on a Windows computer with a name that ends with a dollar sign. By default, these shares share out the contents of every drive on a system and also include shares like admin$ and IPC$ to perform various administrative functions. In Windows 10, these administrative shares still exist but require an extra step in order to work properly. Let's go over how to setup these administrative shares in Windows 10.

MORE: How To Set Up And Use File History In Windows 10
MORE: How To Add Windows 10 To A Domain
MORE: Windows 10 How Tos

First, in domain environments, the administrative Windows 10 shares work as they always have. You simply provide a domain user account with permission to connect to the remote machine and it works. However, an issue arises when you have two Windows 10 computers in a workgroup. While in a workgroup, when you attempt to connect to an administrative share on a Windows 10 computer you will be prompted for a username and password as expected but you will receive a misleading Access Denied error message.

This is related to User Account Control (UAC) and requires a registry modification in order to work properly. By default, UAC remotely restricts these shares from being accessed. In order to successfully connect to an administrative share, you'll need to disable this feature. To do this, you'll need to create (or modify) a registry DWORD value called LocalAccountTokenFilterPolicy and set it to a value of 1.

To do this, either log onto the console of the remote machine locally, via remote desktop or some other remote console application. Then, type in regedit in the search bar, which will bring up the registry editor.



Once in the registry editor, drill down to the path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Then, right click on the System, click on New and then choose DWORD (32-bit) Value.


From here, you are given the option to name the new registry value. Give it a name of exactly LocalAccountTokenFilterPolicy and hit Enter.


Once you've created the registry key, it will have a value of 0; this needs to be a 1. To change it to a 1, double click on the registry value and put a 1 in for Value data.


This will create the registry value and should be all you need to connect to the administrative share successfully. This method should open up all administrative shares which consist of the C$, any additional drive shares, admin$ and IPC$.

When this step is complete, attempt to connect to an administrative share again. You should again be prompted for a username and password. Once given the appropriate credentials, you should now be presented with a file system listing of everything in the location that the share represents.

--- End quote ---

cranioscopical:
Thanks for... er... sharing that.
Seriously, thanks! It goes into my shoot foot, apply bandage file.
 

f0dder:
The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros.
--- End quote ---
s/pros/skiddies.

Sure, they're useful for legit admin actions, but they're one of the first things I disable after I install Windows :)

wraith808:
The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros.
--- End quote ---
s/pros/skiddies.

Sure, they're useful for legit admin actions, but they're one of the first things I disable after I install Windows :)
-f0dder (June 15, 2017, 03:49 AM)
--- End quote ---


What does that first line mean?

And I use it at home so I don't have to replicate this and share the root of my drive on my auxiliary machine.  When I need to get to a file, it's easier to go to the admin share than to go to that machine, locate the file on that machine, copy it to my network, go back to my primary, find it on the network and copy it locally.

Deozaan:
It means, "replace 'pros' with 'skiddies'" which I believe means script kiddies.

Navigation

[0] Message Index

[#] Next page