How to remove SHARE

50Twuncle

I have just run MS Baseline Security Analyser on my Win 10 laptop which has picked up that I have 3 shares set up - So I want to close them
One is worrying me - "remote PC - IPC$" it refuses to close
According to Technet :

The IPC$ is a hidden share maintained by the Server service (Disabling the service will remove the share). The IPC$ share is used for Inter Proces Communication by using RPC (Remote Procedure Call), allowing the client to send different commands to the server:

• List all shares
• List all users
• List files within a share
• Stop/Start services

This could be an open backdoor to allow MS to snoop ?

I have stopped "server service" in SERVICES to see what happens and nothing amiss has so far occurred !!!

esuhl

Your router's firewall should stop remote users from accessing the share.

And isn't the share required for SMB to function? Can you still share files on your LAN?

https://en.wikipedia.org/wiki/Server_Message_Block#Client-server_approach

I just found this page on the Microsoft TechNet site that says this:

In Windows Vista, [shared folders such as C$ and IPC$] are configured by default not to be accessible remotely.

I imagine this applies to post-Vista OSes too, so perhaps it's a complete non-issue now.

unforeseen

If you disable the Server service it will remove the IPC$ share.

However you may well find other services and processes sharing files and printers will then give problems if you do that.

hans_2

To disable administrative shares while retaining file and print sharing you need to edit registry.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\LanmanServer\Parameters

Create a new DWORD value here, naming it AutoShareWks. Leave its value data as 0

Restart your laptop.

N.B. For some reason the word Services will not post correctly although fine in preview.

esuhl

hans_2 wrote: »

To disable administrative shares while retaining file and print sharing you need to edit registry.

Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\LanmanServer\Parameters

Create a new DWORD value here, naming it AutoShareWks. Leave its value data as 0

Restart your laptop.

Although that will remove some hidden shares, I don't think it will remove the IPC$ share. I can't find a source to confirm that at the moment, though...

hans_2 wrote: »

N.B. For some reason the word Services will not post correctly although fine in preview.

It's a forum bug -- something to do with the maximum number of characters in a sentence.

hans_2

esuhl wrote: »

Although that will remove some hidden shares, I don't think it will remove the IPC$ share. I can't find a source to confirm that at the moment, though..

..

http://winaero.com/blog/disable-administrative-shares-in-windows-10-windows-8-and-windows-7/

esuhl

hans_2 wrote: »

..

http://winaero.com/blog/disable-administrative-shares-in-windows-10-windows-8-and-windows-7/

Huh. Maybe it's just on Windows Server 2008 that the IPC$ share can't be deleted...? (I found that link.)

https://support.microsoft.com/en-gb/kb/954422

I notice this page refers to the AutoShareServer key instead of AutoShareWks, so maybe it's just the server key that doesn't affect IPC$ shares.

50Twuncle

esuhl wrote: »

Huh. Maybe it's just on Windows Server 2008 that the IPC$ share can't be deleted...? (I found that link.)

https://support.microsoft.com/en-gb/kb/954422

I notice this page refers to the AutoShareServer key instead of AutoShareWks, so maybe it's just the server key that doesn't affect IPC$ shares.

Thanks - I have disabled the server and it appears to be fine !!
I do not print from my laptop - so that's not needed
At the same time - I disabled Xbox from the list - why do they insist on adding these unwanted addons ?