Archive

Archive for November, 2010

Deleting Default Shares Using Powershell – Part 2

November 29, 2010 Leave a comment

Having removed the default administrative shares in Part 1 has provided a minimal increase in my security confidence index for the time being but knowing all to well that when the machine is rebooted the shares will return once again takes me back to where I started.    This means that we must take it one step further and edit the registry to permanately remove them going forward. 
Read more…

Categories: Powershell

Deleting Default Shares Using Powershell – Part 1

November 22, 2010 Leave a comment

All Windows systems have several default administrative shares configured which are immediately available after installation.  These shares not only provided direct access to the %SystemRoot%\Windows directory (Admin$) but to the root of all hard drives (C$,D$).  There is also the Inter-Process Communication (IPC$) share which is used to facilitate communication between process and computers over Server Message Blocks (SMB). The shares can be enumerated in Powershell using the Win32_Share class.

Read more…

Categories: Powershell