Monitoring File Shares

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I would like to have the ability to know if anyone has "hit" any of my open shares on my pc, specfically the C$ share. Some users have the ability to browse directly to my machine by using the \\machinename\c$ attribute. I can disable this share within Share Managment, however everytime my pc reboots it enables itself.

I know that many local programs may rely on this share so disabling perminitly maybe a bad idea. I guess I am just looking to "watch" all browsing to my machine from my local LAN.

Thank you in advance
 
You may monitor network access to your machine in general
by use of logon type 3 events, and you may enable auditing
(in NTFS) of the filesystem areas that are shared.

If you have people accessing things using C$ then you have
a bigger problem. C$ can only be used by accounts that the
machine recognizes as having authenticated as an admin.
Non-admins cannot access using the default admin shares.

The admin shares (like C$) will always be recreated at
reboot until you have disabled them. They are not used by
anything that is a standard part of the operation system,
although some remote management capabilities can be lost
when they have been shut off.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Secure Tech said:
I would like to have the ability to know if anyone has "hit" any of my
Click to expand...
open shares on my pc, specfically the C$ share. Some users have the ability
to browse directly to my machine by using the \\machinename\c$ attribute. I
can disable this share within Share Managment, however everytime my pc
reboots it enables itself.
I know that many local programs may rely on this share so disabling
Click to expand...
perminitly maybe a bad idea. I guess I am just looking to "watch" all
browsing to my machine from my local LAN.
 
I understand how to manage file shares by using the Managment Console within XP and that it shows user activity. I should have been more clear - can this be reported on? Meaning, if I leave my pc on over the weekend and return to work on Monday can I report or view past connection history that mayhave been made to my pc?
 
See my reply, and then use an eventlog extraction
and reporting tool.

--
Roger Abell
Microsoft MVP (Windows Server System: Security)
MCSE (W2k3,W2k,Nt4) MCDBA
Secure Tech said:
I understand how to manage file shares by using the Managment Console
Click to expand...
within XP and that it shows user activity. I should have been more clear -
can this be reported on? Meaning, if I leave my pc on over the weekend and
return to work on Monday can I report or view past connection history that
mayhave been made to my pc?
 
Back
Top