hiding a NTFS drive

[DLx/P]

Is there a way to hide a partitioned drive on a network?

 

[Mictlantecuhtli]

On a network? Yes, stop sharing it.

 

[Phantasm66]

You can also put a $ at the end of the sharename, that will hide the share, and stop it appearing inside my network places, thusly:

documents

share should be renamed be to

documents$

 

[Phantasm66]

when you create a partition, it should automatically be shared with a hidden $ ended administrative share, accessible only to accounts with admin rights.

So, your solution may in fact be to merely not mess with the defaults...

 

[poertner_1274]

Why do you need to do this? And like everyone else has said it should default not to share, or share with admin rights. Just make sure you didn't right click on it and go to file sharing, and mark it shared.

 

[Phantasm66]

Yeah... just don't specify an unhidden sharing of the folder AT ALL.

 

[DLx/P]

Well this particular PC is in our operations supervisors office. Where hourly groupleads have access to the PC. The supervisors don't want anyone to see files that may contain employee training records, personal info, hourly wages etc.

I clicked the Do not share flag. But it says that when network services are restarted or when the PC is rebooted. The drive will be shared automatically. I don't want to have to change this all the time.

 

[Phantasm66]

In that case, I am nearly 100 per cent sure that this is referring to the hidden, admin shares that have the $ at the end.

These shares are made by default, and certain network services could depend on them. However, one would require admin rights to access these shares, so unless the user is a network administrator, then there is nothing to fear. Just because its shared does not mean that people can access those shares.

Perhaps conduct some security tests of your own, try logging on to another machine as a normal user, go to start, run, type

\\servername\share$

where servername is servername, share$ is sharename like d$, c$, etc. See if you can access the share or not. I am almost 100 per cent sure than someone who is not an administrator will NOT be able to.

 

[poertner_1274]

I have also created a batch file for my PC at home that will delete net shares like that, so nobody can try to hack into my computer that way. I'll look it up when I get home and let you know if you would like.

 

[Mictlantecuhtli]

You need to edit registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ LanManServer \ Parameters

For servers edit (or add) AutoShareServer with a REG_DWORD value of 0.

For workstations, edit (or add) AutoShareWks with a REG_DWORD value of 0.

Better set both just in case.

 

[DLx/P]

Perhaps conduct some security tests of your own, try logging on to another machine as a normal user, go to start, run, type

\\servername\share$

Says that the network path was not found.

 

[Phantasm66]

Are you definately doing the right thing? I.e.

\\leviathan\c$

where leviathan is the name of the machine?

 

[poertner_1274]

It should prompt you for a username and password.

Thanks for that info Mict. What exactly does that do btw?

 

[Phantasm66]

Well, it should prompt you for a username and password if the computername and sharename are valid. If not, you will get the network path was not found or something very similar back.

 

[Phantasm66]

Originally posted by poertner_1274
It should prompt you for a username and password.

Thanks for that info Mict. What exactly does that do btw?

Likely it disabled the automatic hidden sharing (i.e. with a $ at the end of the share name) on system drives, where the previous default WAS to share them. It also, likely, stops the system from complaining if you unshare those hidden shares.

 

[poertner_1274]

Well right, I was saying if he typed it in correctly and it was shared correctly he should be prompted for a user/pass

 

[Phantasm66]

I was talking about what Mickey posted here:

Originally posted by Mictlantecuhtli
You need to edit registry:

HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ LanManServer \ Parameters

For servers edit (or add) AutoShareServer with a REG_DWORD value of 0.

For workstations, edit (or add) AutoShareWks with a REG_DWORD value of 0.

Better set both just in case.

 

[poertner_1274]

Ah, point taken. Thanks for clarifying Phant

 

[Phantasm66]

Yeah, what I meant was that registry hack probably stops the OS wanting to make hidden admin $ ended shares at all. That's my best guess.

 

[DLx/P]

It still says that the path is not found. Maybe I will just try come type of encryption software to hide those files. Probably better anyway.

 

[Mictlantecuhtli]

Originally posted by Phantasm66
Yeah, what I meant was that registry hack probably stops the OS wanting to make hidden admin $ ended shares at all. That's my best guess.

Good guess

HOW TO: Create and Delete Hidden or Administrative Shares on Client Computers

 

[DLx/P]

Thanks alot for the help, and thanks for the link.