Administrative division

In data processing, under Windows, the administrative divisions are the repertories network shared by defect: that relates to the versions Windows NT 4.0, 2000, the professional versions of XP (NB: for the version of Windows XP known as family edition , this functionality does not exist), Windows Server 2003 and Windows Vista.

There is in particular an administrative division for each Partition of hard drive (example: C$, D$,… etc). There also exists of other administrative divisions:

for the file system root (defined by the Variable of environment %SystemRoot%, for example C:\WINDOWS) under the name of admin$,
For the printers, under the name of PRINT$
For the faxes, under the name of FAX$
For temporary connections by named Pipe (named tubes), under the name of IPC$ (Communication inter-process)

The people having the password of a member of the administrators group will have rights in writing on the administrative divisions network.

Security issue on Internet

The apprentices hacker

These administrative divisions present large security issues if they are on a computer directly connected to Internet. For the apprentices hacker (script kiddies), it is one of the first things which they test when they try to find of the vulnerable PC on Internet.

The administrator of the PC does not realize that it shares all the partitions of sound or its disc (S) hard (S) because the functionality Voisinage network does not post the repertories network ending in the character " $" (dollar). Recall: the vicinity network corresponds to Favoris network \ All the network \ Réseau Microsoft Windows )

If the administrator of the PC removes these administrative divisions, it will have an error message clarifies indicating to him that with next the reboot, these administrative divisions will reappear.

Various possible protections

For a PC connected directly on Internet:

Choisir a Password administrator which resists a Attaque by dictionary
Mettre the service shares network in an inactivated state (NB: to put at the manual state is insufficient)
Configurer its Firewall on the ports NETBIOS in a way adapted to its needs (the firewall of Microsoft or that of another editor)
Modifier the register (attention, this should be made only by one data processing specialist)

Hive: HKLM (HKEY_LOCAL_MACHINE), Key: SYSTEM \ CurrentControlSet \ Services \ LanManServer \ Parameters

Under NT 4.0 waiter/Windows 2000 waiter/Windows Server 2003

Name: AutoShareServer

Under NT 4.0 Workstation/Windows 2000 Professionnel/XP (other that family edition )

Name: AutoShareWks To put the value: 0 (Dated Standard: REG_DWORD)

Mail server Microsoft

These administrative divisions are necessary so that a waiter Microsoft Exchange functions; if it is not the case, an error message will appear.

See too

External references

How to make to create and remove divisions hidden or administrative on computers customers
PC-WELT discovers and serious security resulting in Windows XP SP2

Random links: