Default Share access only for domain administrator (XP Professional SP2)

[siciliano]

Hi folks

I'm stuck with the Windows XP default share access. The idea behind my
plan is that the domain administrator should be able to access all
client default shares. Right now all users can access every default
share in the network (change permission).

If I unmark the function "file and printer sharing" neither the domain
users nor the domain administrator can access the default shares
anymore.

What is the best practice for such an access implementation?

Thanks a lot in advance for your support!

Leonardo

 

[Kerry Brown]

Are you talking about the hidden admin shares (eg C$)? If all users have
access to them then security is lacking on your network. Either all users
are using the same account or all users are domain admins. If this isn't the
case post some more details. Are the shares on the server or workstations?

 

[siciliano]

Hi Kerry

Are you talking about the hidden admin shares (eg C$)?

yes, exactly

Either all users are using the same account or all users are domain admins.

I don't hope so ;-)

Are the shares on the server or workstations?

workstations

Leonardo

 

[Kerry Brown]

Have you added "domain users" or any other domain groups to the local
administrators group? If the users have local administrator rights (i.e.
they are a member of a domain group that is a member of the local
administrators group) they will be able to access the admin shares. There is
no easy way around this and still let domain admins have access. You have to
remove all the domain groups except domain administrators from the local
administrators.