Shares¶
A share is a folder made reachable over the network. Each one is a place an attacker with any account (or, with bad settings, no account) can read or write.
List them¶
Get-SmbShare
Name ScopeName Path Description
---- --------- ---- -----------
ADMIN$ * C:\Windows Remote Admin
C$ * C:\ Default share
IPC$ * Remote IPC
Public * C:\Users\Public
Finance * C:\Finance
Shares ending in $ are administrative shares Windows creates itself. They're only reachable by administrators and are normal. Everything else is a decision.
For each share¶
Ask: does the README say people reach these files from other machines? If not, remove the share.
Remove-SmbShare -Name Public -Force
GUI: compmgmt.msc → Shared Folders → Shares → right-click → Stop Sharing.
For a share that stays, check who can reach it and how:
Get-SmbShareAccess -Name Finance
Name AccountName AccessControlType AccessRight
---- ----------- ----------------- -----------
Finance Everyone Allow Full
Everyone with Full is the default when a share is created carelessly. Tighten it to the group that needs it:
Revoke-SmbShareAccess -Name Finance -AccountName Everyone -Force
Grant-SmbShareAccess -Name Finance -AccountName "Finance" -AccessRight Change -Force
Share permissions and NTFS permissions both apply; the more restrictive wins. See Share Permissions.
Shared drives¶
Sharing C: puts the whole disk on the network. Check: right-click Local Disk (C:) → Properties → Sharing → Advanced Sharing → Share this folder should be unticked. The C$ administrative share is different and stays.
Verify¶
Get-SmbShare | Where Name -notlike "*$"
Should list only shares the README justifies, and Get-SmbShareAccess on each should not show Everyone with Full or Change.
Example¶
The README says the machine is a workstation and nothing is shared. Get-SmbShare shows Public and Users. Remove both. The $ shares stay.