Re: Basic Security Questions

On Fri, 14 Oct 2005 22:25:01 -0700, "BobW"

>2. MS Baseline Analyzer 2 is not happy with the number of shares on my PC
>and would like me to change permissions or eliminate a few. When I go to
>Control Panel/ Administrative Tools/ Computer Management, each share I "open"
>says "This has been shared for Administrative purposes. The share permissions
>and file security cannot be set". My four shares are: ADMIN$, C$, E$ and
>IPC$. What should I do?

It's not "how many" shares, but what is exposed.

In this respect, c$ is a bloody menace! It exposes several startup
points into which malware can drop code, so that this code will run
the next time the PC starts up.

XP Home is said to disable these admin shares.

XP Pro is said to disable access to these shares if the account
password is null, but will expose them if password is not null. So
your "defence" then may hinge on the strength of that password.

If possible, don't bind File and Print Sharing to untrusted networks.
The Internet is the mother of all of these.

You can kill c$, e$ etc. (but not IPC$) via this .REG...


Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Servic es\lanmanserver\parameters]
"AutoShareServer"=dword:00000000
"AutoShareWks"=dword:00000000


....but this setting can be reversed by malware, malware clean-up, and
various "just re-install" etc. scenarios.



>--------------- ---- --- -- - - - -
I'm baaaack!
>--------------- ---- --- -- - - - -