Управление административными шарами (Admin$, IPC$, C$, D$) в Windows 10

Административные общие ресурсы (шары) используются в Windows для удаленного доступа и управления компьютером. Если открыть консоль управления компьютером ( compmgmt.msc ), развернуть секцию System Tools -> Shared Folders -> Share (Общие папки -> Общие ресурсы) или выполнить команду net share , вы увидите список административных общих папок (эти папки скрыты в сетевом окружении и доступ к ним ограничен).

По-умолчанию Windows создает следующие админ шары:

• Admin$ — Remote admin (это каталог %SystemRoot%)
• IPC$ — Remote IPC (используется в named pipes)
• C$ — Default Share

Если на компьютере имеются другие разделы, которым назначена буква диска, они также автоматически публикуются в виде административных шар ( D$ , E$ и т.д.). Если вы предоставляете общий доступ к принтеру, то должна быть шара Print$ или FAX$ — при использовании факс-сервера.

Обратите внимание, что имена общих административных шар заканчиваются знаком $. Этот знак заставляет службу LanmanServer скрывать данные SMB ресурсы при доступе по сети (конкретные файлы и папки в общем сетевом каталоге можно скрыть с помощью Access-Based Enumeration). Если вы попытаетесь в проводнике отобразить список доступных на компьютере сетевых папок ( \\computername ), вы не увидите их в списке доступных общих SMB каталогов.

Можно получить список доступных административных шар на удаленном компьютере с помощью команды:

net view \\computername /all

Чтобы открыть содержимое административной шары из File Explorer, нужно указать ее полное имя. Например, \\computername\c$ . Данная команда откроет содержимое локального диска C и позволит вам получить полноценный доступ к файловой системе системного диска удаленного компьютера.

Получить доступ к административным шарам могут только члены локальной группы администраторов компьютера (и группы Backup Operators) при условии, что у вас включен SMB протокол, общий доступ (Turn on file and printer sharing) и доступ по 445 порту TCP не блокируется Windows Defender Firewall.

Как отключить/включить административные шары в Windows 10?

Административные шары Windows удобны для удаленного администрирования компьютера, но несут дополнительные риски безопасности (Как минимум не стоит использовать одинаковый пароль локального администратора на всех компьютерах. Чтобы сделать пароли уникальными, используйте LAPS). Вы можете полностью запретить Windows создавать эти скрытые ресурсы.

Самый простой способ – щелкнуть правой кнопкой мыши по имени административного ресурса в оснастке управления компьютером и выбрать Stop sharing (или использовать команду net share IPC$ /delete ). Однако после перезагрузки Windows она пересоздастся автоматически.

Чтобы запретить Windows публиковать административные шары, нужно открыть редактор реестра regedit.exe, перейти в ветку реестра HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters и добавить Dword параметр с именем AutoShareWks (для десктопных версий Windows) или AutoShareServer (для Windows Server) и значением 0.

Можно создать это параметр реестра вручную, из командной строки reg add или через PowerShell:

reg add HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /f /v AutoShareWks /t REG_DWORD /d 0

New-ItemProperty -Name AutoShareWks -Path HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters -Type DWORD -Value 0

Теперь после перезагрузки административные шары не будут создаваться. При этом перестанут работать утилиты удаленного управления компьютером, в том числе psexec.

Если вы хотите включить админские шары, нужно изменить значение параметра на 1 или удалить его.

Set-ItemProperty -Name AutoShareWks -Path HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters -Value 1

Чтобы Windows пересоздала административные шары, достаточно перезапустить службу Server командой:

Разрешаем удаленный доступ к административным шарам Windows 10

При работе с административными шарами Windows на компьютере, который не добавлен в домен Active Directory (состоит в рабочей группе) есть одна важная особенность. Windows 10 блокирует удаленный доступ к дефолтным административным шарам под пользователем, входящим в группу локальных администраторов. Причем под учетной записью встроенного локального администратора (по умолчанию она отключена) такой доступ работает.

Немного подробнее как выглядит проблема. Я пытаюсь с удаленного компьютера обратится к встроенным административным ресурсам компьютера Windows 10, состоящего в рабочей группе (при отключенном файерволе) таким образом:

В окно авторизации ввожу имя и пароль учетной записи, состоящей в группе локальных администраторов Windows 10, на что появляется ошибка доступа (Access is denied). При этом доступ к общим сетевым каталогам и принтерам на Windows 10 работает нормально (компьютер виден в сетевом окружении). Доступ под встроенной учетной записью administrator к административным ресурсам при этом тоже работает. Если же этот компьютер включить в домен Active Directory, то под доменными аккаунтами с правами администратора доступ к админским шарам также не блокируется.

Дело в еще одном аспекте политики безопасности, появившемся в UAC – так называемом Remote UAC (контроль учетных записей для удаленных подключений), который фильтрует токены доступа локальных записей и аккаунтов Microsoft, блокируя удаленный административный доступ под такими учеткам. При доступе под доменным аккаунтом такое ограничение не применяется.

Отключить Remote UAC можно путем создания в системном реестре параметра LocalAccountTokenFilterPolicy

1. Откройте редактор реестра (regedit.exe);
2. Перейдите в ветку реестра HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ;
3. Создайте новый параметр типа DWORD (32-bit) с именем LocalAccountTokenFilterPolicy;
4. Установите значение параметра LocalAccountTokenFilterPolicy равным 1;
5. Для применения изменений потребуется перезагрузить компьютер

reg add «HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System» /v «LocalAccountTokenFilterPolicy» /t REG_DWORD /d 1 /f

После перезагрузки попробуйте удаленно открыть административный каталог C$ на Windows 10 компьютере. Авторизуйтесь под учетною записью, входящей в группу локальных администраторов. Должно открыться окно проводника с содержимым диска C:\.

Итак, мы разобрались как с помощью параметра LocalAccountTokenFilterPolicy разрешить удаленный доступ к скрытым админ-ресурсам для всех локальных администраторов компьютера Windows. Инструкция применима также к Windows 8.1, 7 и Windows Server.

How to share files and printers without HomeGroup on Windows 10

Source: Windows Central

On Windows 10, HomeGroup was a feature to simplify the process of sharing resources across a small network with other users. However, since the feature has been removed, you now have to use different methods to share files, folders, and printers.

Some of these methods include Share and Nearby sharing, OneDrive, and the more advanced sharing options that offer virtually the same experience but using a different set of instructions.

In this Windows 10 guide, we’ll walk you through the steps to share files and printers inside the local network without HomeGroup.

How to share files on Windows 10

Windows 10 offers several ways to share files and folders with other users, including using the Share feature, OneDrive, and setting up a more advanced configuration File Explorer.

Send files with Share

If you have to share one or more files with another user inside the home network, office, or across the world only one time, you can use the Share feature, which comes built into File Explorer and most modern apps.

To share files using the Share feature on Windows 10, use these steps:

1. Open File Explorer.
2. Browse to the folder location with the files.
3. Select the files.

Click on the Share tab.

Quick tip: Alternatively, you can right-click the selection and choose the Share option in the context menu. Also, the Share option can be found in many apps that you acquire from the Microsoft Store.

Click the Share button.

Source: Windows Central

Select the app, contact, or nearby sharing device.

Source: Windows Central

Continue with the on-screen directions to share the content.

Although this is a sharing feature, you’re technically sending the files to another destination. If you’re about to share files with a nearby device, note that «Nearby sharing» needs to be enabled on the source and destination computers to work correctly. You can learn more about nearby sharing, in this guide.

Share files with OneDrive

On Windows 10, you can also use OneDrive to share files or folders with family, friends, or colleagues.

Unlike sending files using the Share feature, OneDrive allows you to share virtually any file by creating a secure link that others can use to access the content, which you can also revoke at any time.

To share files with OneDrive, use these steps:

1. Open File Explorer.
2. Click the OneDrive folder from the left pane.
3. Browse to the folder with the files.

Right-click the file and select the Share option (blue icon).

Source: Windows Central

Clear the Allow editing option if you only want someone else to view the file.

Quick tip: If you have a Microsoft 365 subscription or OneDrive plan, you can also set the expiration date and password for the link.

Confirm the email address of the person you want to share the file. Or click the Copy Link option to copy the link to the clipboard.

Source: Windows Central

(Optional) Add a personalized message for the share.

Click the Send button.

After you complete the steps, the recipient will receive the link to access the shared file, and depending on the settings, the recipient will be able to view or edit the file.

Stop file sharing

To stop sharing a file in OneDrive, use these steps:

1. Open File Explorer.
2. Click the OneDrive folder from the left pane.
3. Browse to the folder with the share.

Right-click the shared file and select the Share option (blue icon).

Source: Windows Central

Select the Manage Access option.

Source: Windows Central

Click the Can edito button and select the Stop sharing option.

Source: Windows Central

Once you complete the steps, the files will no longer be accessible by other people with the link.

Share files with File Explorer

When you have to share multiple files in the local network, you can use the File Explorer advanced sharing options.

Quick tip: When sharing a folder, usually, you want to share the folder by creating a folder in the root of the «C» drive or secondary drive or partition. Always avoid sharing files from the system folders, including Desktop, Documents, Pictures, etc.

To create a basic folder share on Windows 10, use these steps:

1. Open File Explorer.
2. Browse to the folder with the content that you want to share.

Right-click the folder, select the Give access to option, and click the Specific people option.

Source: Windows Central

Use the drop-down menu, and select the user or group to share the folder and its contents. Options available include:

• Local users — When you choose individual accounts, the user must provide username and password to access the files. If the user is signed in using the same credentials on their computer, then they may be able to access the data without any prompts.
• Everyone — Shares the contents with anyone in the network without entering a password to access the files.

Quick note: You may also find an option to create a new account, but it won’t be useful since Windows 10 no longer allows the creation of new accounts using Control Panel.

Click the Add button.

Source: Windows Central

Under the «Permission Level» column, select the permissions that user will have to access the contents:

• Read — Gives network users the ability to list and open files, but they won’t be able to modify or delete existing files and folders. Also, they won’t be able to upload or create new folders or files.
• Read/Write — Allows users to list, open, modify, delete, upload, and create new files and folders.
• Remove — Blocks the specified user or group from accessing the folder.

Click the Share button.

Source: Windows Central

Right-click the shared folder path and select the Copy Link option.

Source: Windows Central

Click the Close button.

After you complete the steps, you can share the link (which you copied to the clipboard on step No. 8) with users in the local network.

Connect to shared files over the network

To access a shared folder on Windows 10, use these steps:

Open File Explorer.

Right-click and paste the network path for the shared folder in the address bar and press Enter.

Source: Windows Central

Confirm your account credentials (if applicable).

Upload, download, or modify files as necessary.

If you’re logged on using a username and password that matches the credentials on the device sharing the folder, you may not need to sign in again to access the shared folder. However, if you’re prompted to log in, you must enter the account credentials of an account located on the computer sharing the folder.

Alternatively, users can also use the «Network» page from the File Explorer from left pane to browse the computer and access the shared folder contents.

When sharing folders in the network, users will only be able to access the files if the computer sharing the folder is on and connected to the network.

Stop sharing files over the network

If you no longer wish to share files in the network, use these steps:

1. Open File Explorer.
2. Browse to the folder with the content that you want to share.

Right-click the folder, select the Give access to option, and click the Remove access option.

Source: Windows Central

Click the Stop sharing button.

Source: Windows Central

Once you complete the steps, the content will no longer be accessible through the network.

Troubleshoot access to shared files

When sharing a folder or printer, there’s a chance you won’t be able to access the resources because of a problem translating the computer name to a TCP/IP address, issues with the firewall, or network profile settings.

Use IP address instead of computer name

To determine the device network address to replace the computer name in the path to access the shared resources, use these steps:

1. Open Settings.
2. Click on Network & Internet.
3. Click on Status.

Click the Properties buttons for the current Ethernet or Wi-Fi connection.

Source: Windows Central

Under the «Properties» section, confirm the current IPv4 address.

Source: Windows Central

In the network path to the shared folder, replace the computer name with the IP address.

For example, after editing the link, the unique path should look like this: //10.1.2.173/share instead of //homepc/share .

Source: Windows Central

After you complete the steps, you should now be able to access the network content.

Change network profile to private

If the computer is using the public network profile, the folder or printer won’t be discoverable in the network. As a result, trying to access the resources will require to enter credentials. To avoid this issue, you must set the network profile to private on every computer.

To set the network profile to private, use these steps:

1. Open Settings.
2. Click on Network & Internet.
3. Click on Status.

Click the Properties buttons for the current Ethernet or Wi-Fi connection.

Source: Windows Central

Under the «Network profile» section, select the Private option.

Source: Windows Central

Once you complete the steps, users should be able to access shared files and printers from any computer in the local network.

Configure access through firewall

You can temporarily disable the firewall on both devices to determine if that is the cause of the problem. If the firewall blocks access to the shared folder, you’ll need to open the corresponding ports.

Disable Microsoft Defender Firewall

To temporarily disable the firewall on Windows 10, use these steps:

1. Open Windows Security.
2. Click on Firewall & network protection.

Click the Private network option.

Source: Windows Central

Turn off the Microsoft Defender Firewall toggle switch.

Source: Windows Central

Quick tip: after finding out the issue, make sure to turn the firewall back on.

After you complete the steps, repeat the steps on the device, and then try to access the shared folder. If it’s a firewall problem, then you’ll need to open the corresponding network port. Also, after resolving the issue, remember to re-enable the firewall using the same instructions outlined above, but on step No. 4, make sure to turn on the Microsoft Defender Firewall toggle switch.

Open Microsoft Defender Firewall ports

To allow file and printer sharing through the firewall, use these steps:

1. Open Windows Security.
2. Click on Firewall & network protection.

Click the Allow app through firewall option.

Source: Windows Central

Click the Change settings button.

Source: Windows Central

Select the File and Printer Sharing option, and make sure to check the Private network option.

Source: Windows Central

Click the OK button.

Once you complete the steps, network users should be able to access the shared folder even with the firewall turned on.

If you’re using a third-party firewall solution, you’ll need to check your vendor support website for specific details on how to get around this problem.

How to share printers on Windows 10

In previous versions, the easiest method to share a printer was using HomeGroup, but now even without the feature, you can still share a USB printer with other users in the local network.

Important: If you have a printer with a built-in print server, it’s recommended to use that feature. You can refer to the printer manufacturer support website for instructions on connecting the device to the network. If you’re dealing with a print server, you only need to follow the steps below to share the printer and connect the computers.

Share printer on Windows 10

To share a printer on Windows 10 (assuming it’s already installed), use these steps:

1. Open Settings.
2. Click on Devices.
3. Click on Printers & scanners.
4. Under the «Printer & scanners» section, select the printer that you want to share.

Click the Manage button.

Source: Windows Central

Click the Printer properties option.

Source: Windows Central

In the «Share name» field, specify a new short and descriptive name. (If this is the only printer on the network, you can use the default name.)

Source: Windows Central

Click the Apply button.

Click the OK button.

After you complete the steps, the printer will be available to network users, but only if the computer is on.

Connect computer to shared printer

To connect devices to the shared printer, use these steps:

1. Open Settings.
2. Click on Devices.
3. Click on Printer & scanners.
4. Click the Add a printer or scanner button.
5. Select the printer from the list.

(Optional) If the discovery feature doesn’t work, click The printer that I want isn’t listed option.

Source: Windows Central

Type the path of the printer location:

Source: Windows Central

In the command, make sure to change the «xxx.xxx.xxx.xxx» and «PRINTER-SHARE-NAME» for the IP address (or computer name) and name of the printer.

Quick tip: You can also click the Browse button to select the shared printer.

(Optional) Specify an name of the printer connection. For example, Network Printer.

Source: Windows Central

Click the Next button.

Click the Finish button.

Once you complete the steps, you should be able to successfully send a print job to the network printer.

Connect old devices to shared printer

If you’re running an old version of Windows 10, Windows 8.1, or Windows 7, the steps to connect to the printer will be slightly different.

To connect an old computer to a network shared printer, use these steps:

1. Open Control Panel.
2. Click on Hardware and Sound.
3. Click on the Devices and Printers option.

Click the Add a printer button.

Source: Windows Central

If the discovery feature doesn’t work, click The printer that I want isn’t listed option.

Source: Windows Central

Type the path of the printer location:

Source: Windows Central

In the command, make sure to change the «xxx.xxx.xxx.xxx» and «PRINTER-SHARE-NAME» for the IP address (or computer name) and share the name of the printer that you’re trying to connect.

Quick tip: You can click the Browse button to locate and select the shared printer.

(Optional) Specify an name of the printer connection. For example, Network Printer.

Source: Windows Central

Click the Next button.

Click the Finish button.

After you complete the steps, remember that users will only be able to print as long as the device sharing the printer is powered on and connected to the network. If the computer is sleeping, hibernating, or powered off, no one will be able to print.

Stop sharing printer on Windows 10

If there’s no need to share a printer over the network anymore, then use these steps:

1. Open Settings.
2. Click on Devices.
3. Click on Printers & scanners.
4. Under the «Printer & scanners» section, select the printer that you want to share.

Click the Manage button.

Source: Windows Central

Click the Printer properties option.

Source: Windows Central

Clear the Share this printer option.

Source: Windows Central

Click the Apply button.

Click the OK button.

Once you complete the steps, the printer will no longer be available for network users.

Wrapping things up

Windows 10 includes many features and advanced settings to share resources with network users, but in this guide, we’re focusing on using the essential configurations to help users coming from HomeGroup.

If you’re in an environment running different versions of Windows, you can still refer to this guide to share files and printers on older releases of Windows 10, Windows 8.1, and even Windows 7.

More Windows 10 resources

For more helpful articles, coverage, and answers to common questions about Windows 10, visit the following resources:

We may earn a commission for purchases using our links. Learn more.

Halo: MCC’s live service elements make it better, not worse

Halo: The Master Chief Collection is more popular than ever, but some fans don’t agree with the live service approach 343 Industries has taken with it. Here’s why those elements are, at the end of the day, great for the game and for Halo overall.

Microsoft’s Surface Duo is not ‘failing up’

Microsoft announced this week that it was expanding Surface Duo availability to nine new commercial markets. While Surface Duo is undoubtedly a work in progress, this is not a sign of a disaster. It’s also doesn’t mean that Surface Duo is selling a ton either. Instead, the reason for the expansion is a lot more straightforward.

Here’s what you can do if Windows 10 update KB5001330 is causing issues

In this guide, we’ll show you the steps to get rid of the update KB5001330 to fix profile, gaming, and BSoD problems with the Windows 10 October 2020 Update and May 2020 Update.

These are the best PC sticks when you’re on the move

Instant computer — just add a screen. That’s the general idea behind the ultra-portable PC, but it can be hard to know which one you want. Relax, we have you covered!