Shares Security

[Ice Czar]

well first off this is for standalone systems and can play havoc in a networked environment

in addition the Group Shares under the Security Tab in a drive's properties are NTFS permissions, so use NTFS its far more secure than FAT32

remove the "Everyone" group shares and replace with "Authenticated Users" shares
the Everyone Group allows access to all the data by anyone that manages to log on to the network

Start > Programs > Accessories > Windows Explorer > (in tree at left) expand My Computer > RClick the first drive > Properties > Security Tab > Add > Authenticated Users > Add > OK >
then Remove > Everyone > Apply > OK

Repeat for each drive (except removable media) with drives that have Administrator and System permissions leave those permissions intact

disable default hidden shares
$C, $D, $E ect the root for each partition (these are typicaly accessed by the Administrator or Backup Operators Groups)
Start > Programs > Accessories > Windows Explorer > (in tree at left) expand My Computer > RClick the first drive > Properties > Sharing Tab > Check Do not share this folder radio button > Apply > OK

repeat for each drive

Delete default administrative shares for the current and later sessions
Start > Run > (type) Regedit > Navigate to >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
RClick the right pane > New > DWORD Value > (type) > AutoShareWks
and verify the value is 0x00000000 (0)

(both Microsoft Systems Management Server (SMS) and Microsoft Operations Manager (MOM) 2000 require administrative shares for correct installation and operation.)

disabling IPC$ Shares
for this you will need to download a few files (included in a few resource kits)
download here (autoexnt package)
you should have
Instexnt.exe
Autoexnt.exe
Servmess.dll

then open the notepad and type > net share IPC$ /delete
save as > Autoexnt.bat

than copy all 4 to WINNT\system32
then Start > Run > CMD > (type) instexnt install
at the command prompt > Enter
you should get

C:\Documents and Settings\Administrator > instexnt install
CreateService AutoExNT SUCCESS
 with InterActive Flag turned OFF.

C:\Documents and Settings\Administrator>

then Start > Run > regedit (XP\W23) or regdt32 (W2K\NT) naviagte to > HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\AutoExNT
Highlight it and on the top toolbar > Edit > Add value > (type) DependOnService > select REG_MULTI_SZ as the data type from the dropdown list > OK > a Multi-String Editor window will popup type > LanManServer > and > LanManWorkstation > OK

if the DependOnService value already exists, simply double click it and add
LanManServer > and > LanManWorkstation

Now reboot and after startup
Start > Run > compmgmt.msc > Expand Share Folders > Select Shares > you shouldnt see anything

what has effectively been done is you have installed a service that starts a batch file at startup, now you really need to protect that file, Id recommend hiding it, and placing a file checker or other security monitoring utility to watch it for changes, any other batch commands youd like to add could also be included

 

[odoe]

I just did a new install of my OS this weekend and was thinking about what I have forgotten to do. Good tips.

 

[SJConsultant]

Shouldn't this be in the networking and security forum for more exposure?

 

[Ice Czar]

Shouldn't this be in the networking and security forum for more exposure?

this is just a part of the security FAQ > HELP Im infected with... a General Software Production

but anyone can chime in to add suggestions, while that FAQ is locked
the threads it links to (such as this) arent

Im finally going through and fleshing it out since Im in the process of securing a new computer I built for my brother

also see the new modual > File Extentions Security, Hidden Files

 

[lomn75]

Ice: do you know what the distinction is between "Everyone" and "Authenticated Users" is for XP? I know XP removed anonymous users from "Everyone" (by default, at least -- it can be changed), so I had assumed that the two were now equivalent.

 

[Ice Czar]

right now this is oriented towards W2K since thats what I use on most of my machines

well the Home edition employs simple file sharing forcing network logons to a guest account, and you use the "make private" on a folder basis

for XPPro on the other hand
How to set, view, change, or remove file and folder permissions in Windows XP @ microsoft

which says you cant deep six hidden shares
but actually you can its the same as W2K
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q314984&sd=tech

the basic breakout of Everyone, Users and Authenticated Users is here
http://www.winnetmag.com/Web/Article/ArticleID/23581/23581.html


for XP refer to > Differences in default security settings @ Microsoft

The Anonymous Logon group is no longer a member of the Everyone group. This change will impact anonymous users attempting to access resources hosted on computers running Windows XP Professional.

and Memberships Associated with Default Groups

but I gather the main differences regarding Authenticated Users and Everyone Groups in XP Pro has to do with Active Directory Databases

http://www.techtutorials.com/tutorials/xp/managing_groups.shtml

Everyone
The Everyone group contains all of the users who access the computer. The Full Control permission is assigned to the Everyone group (and thus all the users in it) whenever there are volumes on the local system formatted with NTFS.

Authenticated Users
All users with valid user accounts on the local system are included in the Authenticated Users group. When your Windows XP systems is a member of a domain, (or multiple domains) it includes all users in the Active Directory database for that given domain. Using the Authenticated Users group for resource and system access instead of the Everyone group is a suggested best practice.

which also applies to W2K, but now the Everyone group has the further anonymous restrictions