Using Windows 10 Administrative Shares

[wraith808]

Today, I needed to connect to the administrative share on my other box.  To my consternation, it didn't work, giving me an access denied message.  After a bit of searching, I came up with a link on TomsIT Pro.com on this very issue.

It's in the process of archiving on archive.is at http://archive.is/ox74W

Duplicated Below in plain text:

Using Windows 10 Administrative Shares
By Adam BertramMARCH 29, 2016 1:00 PM
     
In Windows 10, administrative shares work the same in domain environments. But when dealing with Windows 10 systems in a workgroup you'll have to use a workaround to get access to administrative Windows 10 shares—here's how.



The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros. Administrative file shares are the hidden shares on a Windows computer with a name that ends with a dollar sign. By default, these shares share out the contents of every drive on a system and also include shares like admin$ and IPC$ to perform various administrative functions. In Windows 10, these administrative shares still exist but require an extra step in order to work properly. Let's go over how to setup these administrative shares in Windows 10.

MORE: How To Set Up And Use File History In Windows 10
MORE: How To Add Windows 10 To A Domain
MORE: Windows 10 How Tos

First, in domain environments, the administrative Windows 10 shares work as they always have. You simply provide a domain user account with permission to connect to the remote machine and it works. However, an issue arises when you have two Windows 10 computers in a workgroup. While in a workgroup, when you attempt to connect to an administrative share on a Windows 10 computer you will be prompted for a username and password as expected but you will receive a misleading Access Denied error message.

This is related to User Account Control (UAC) and requires a registry modification in order to work properly. By default, UAC remotely restricts these shares from being accessed. In order to successfully connect to an administrative share, you'll need to disable this feature. To do this, you'll need to create (or modify) a registry DWORD value called LocalAccountTokenFilterPolicy and set it to a value of 1.

To do this, either log onto the console of the remote machine locally, via remote desktop or some other remote console application. Then, type in regedit in the search bar, which will bring up the registry editor.



Once in the registry editor, drill down to the path HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System. Then, right click on the System, click on New and then choose DWORD (32-bit) Value.


From here, you are given the option to name the new registry value. Give it a name of exactly LocalAccountTokenFilterPolicy and hit Enter.


Once you've created the registry key, it will have a value of 0; this needs to be a 1. To change it to a 1, double click on the registry value and put a 1 in for Value data.


This will create the registry value and should be all you need to connect to the administrative share successfully. This method should open up all administrative shares which consist of the C$, any additional drive shares, admin$ and IPC$.

When this step is complete, attempt to connect to an administrative share again. You should again be prompted for a username and password. Once given the appropriate credentials, you should now be presented with a file system listing of everything in the location that the share represents.

[cranioscopical]

Thanks for... er... sharing that.
Seriously, thanks! It goes into my shoot foot, apply bandage file.
 

[f0dder]

The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros.

s/pros/skiddies.

Sure, they're useful for legit admin actions, but they're one of the first things I disable after I install Windows

[wraith808]

The administrative shares that have been part of Windows for a long time have been a staple for remote file management for IT pros.

s/pros/skiddies.

Sure, they're useful for legit admin actions, but they're one of the first things I disable after I install Windows

-f0dder (June 15, 2017, 03:49 AM)

What does that first line mean?

And I use it at home so I don't have to replicate this and share the root of my drive on my auxiliary machine.  When I need to get to a file, it's easier to go to the admin share than to go to that machine, locate the file on that machine, copy it to my network, go back to my primary, find it on the network and copy it locally.

[Deozaan]

It means, "replace 'pros' with 'skiddies'" which I believe means script kiddies.

[wraith808]

Is that regex?  Or something else?

[Deozaan]

I can't recall what it's from. All the smart Linux geeks (of which group I do not claim to be a part of) I know are familiar with it. It might be a standard Linux command/tool which is combined with regex.

I've seen people use it for years in the IRC channel, and from context I learned to just think of it as saying, in the example of "s/this/that", "switch this for that." So I've used it from time to time as well, not knowing anything of its origin. I only recently learned it was from something specific, which as I said, I think is Linux-centric.

Edvard would know what it's from. I'm sure f0dder would, too.

[rjbull]

I think it's "replace" syntax for Unix 'sed' Stream EDitor, see e.g.https://www.gnu.org/...-_0022s_0022-Command

[Ath]

it's "replace" syntax for Unix 'sed' Stream EDitor

-rjbull (June 19, 2017, 02:21 AM)

And for vi/vim

[ConstanceJill]

s/pros/skiddies.

-f0dder (June 15, 2017, 03:49 AM)

sed: -e expression #1, char 16: unterminated `s' command

[Ath]

s/pros/skiddies.

-f0dder (June 15, 2017, 03:49 AM)

sed: -e expression #1, char 16: unterminated `s' command

-ConstanceJill (June 19, 2017, 05:27 AM)

Someone mistyped a . for a /  (they are quite close together on a US keyboard layout )

[f0dder]

Someone mistyped a . for a /  (they are quite close together on a US keyboard layout )

-Ath (June 19, 2017, 06:02 AM)

Yes, yes! That was... definitely!... what happened ;P