Pb With Ipc Share On Xp ?

GovernmentSecurity.org > The Archives > General Network Security

Neo_

Aug 24 2004, 10:54 PM

Hi,
i'm looking for a documentation on windows shares, ipc$, admin$, port 139, on 2000, and on XP.
Cause a few people says that :
- on 2000, NT, deleting shares is enough to secure ipc$
- on XP, sometimes, shares are working after being deleted.
Plz help me to explain this
---Edit : found this :
IPC$:
=====
IPC$ is shared by default. You can use the command "net share IPC$
/delete" to stop the machine from listening on it, but when the Server
service is restarted (or a reboot) IPC$ will be shared again. The Server
service is in place when "File and Printer Sharing for Microsoft Networks"
is installed.

There is no way to force XP to stop listening on IPC$ permanently OTHER
than uninstalling "File and Printer Sharing for Microsoft Networks".
Uninstalling this disables the ability to share any folders and other
machines would not be able to connect to your machine via SMB and RPC.
Examples of this would be Start - Run - \\machinename or the "net use" or
"net view" commands, file copies, etc.

AutoShare of Volumes:
====================
Through the registry you can disable the automatic sharing of Admin$, and
all of the volume shares that are created automatically.

The following KBs give the details:
318751 HOW TO: Remove Administrative Shares in Windows 2000 or Windows NT
4.0
http://support.microsoft.com/?id=318751

314984 HOW TO: Create and Delete Hidden or Administrative Shares on Client
http://support.microsoft.com/?id=314984
----

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.


Help - Search - Member List - Calendar Full Version: Pb With Ipc Share On Xp ? GovernmentSecurity.org > The Archives > General Network Security Neo_ Aug 24 2004, 10:54 PM Hi, i'm looking for a documentation on windows shares, ipc$, admin$, port 139, on 2000, and on XP. Cause a few people says that : - on 2000, NT, deleting shares is enough to secure ipc$ - on XP, sometimes, shares are working after being deleted. Plz help me to explain this ---Edit : found this : IPC$: ===== IPC$ is shared by default. You can use the command "net share IPC$ /delete" to stop the machine from listening on it, but when the Server service is restarted (or a reboot) IPC$ will be shared again. The Server service is in place when "File and Printer Sharing for Microsoft Networks" is installed. There is no way to force XP to stop listening on IPC$ permanently OTHER than uninstalling "File and Printer Sharing for Microsoft Networks". Uninstalling this disables the ability to share any folders and other machines would not be able to connect to your machine via SMB and RPC. Examples of this would be Start - Run - \\machinename or the "net use" or "net view" commands, file copies, etc. AutoShare of Volumes: ==================== Through the registry you can disable the automatic sharing of Admin$, and all of the volume shares that are created automatically. The following KBs give the details: 318751 HOW TO: Remove Administrative Shares in Windows 2000 or Windows NT 4.0 http://support.microsoft.com/?id=318751 314984 HOW TO: Create and Delete Hidden or Administrative Shares on Client http://support.microsoft.com/?id=314984 ---- This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.