Administrative Share C$ denying access

[autumn801]

Is there anyway to deny access to the administrative share C$ on any machine.

This user is a member of the local administrative group on the member server.
If he still have local admin rights to the member server will he still be able to get into the box through the administrative share C$?

This user was taken out of Domain Administrative group.

I want to restrict this user from being able to access the administrative shave C$.

Can someone please advise me how I can do that. But he still needs permissions to the member server to do maintenance.

thanks

[Tuttle]

Well, you could disable the administrative shares completely: KB 816524

That said, as long as that user is a local admin, there are plenty of other ways for him to get at everything on the server.

What's the real problem you're trying to solve here?

[autumn801]

I'm trying to restrict users from accessing the administrative share.
Is there any way to audit who accesses the administrative share?

thanks

[Tuttle]

You could use filesystem auditing. That's a two-step process:

• Edit the local security policy and enable Local Policies | Audit Policy | Audit Object Access for Success (and Failure if you want). For a single server you can just run secpol.msc; for a whole bunch you'd probably be better off setting it through Group Policy.
• Enable auditing for each individual file or folder you want accesses logged for. Windows Explorer, right-click | Properties, Security | Advanced | Auditing. You need to add every user/action combination that you want audited (i.e. to log all access, add an entry with Full Control). Note that this isn't changing what people have permission to do, only what will be logged if it's attempted. Those auditing settings are inherited by default, so you can do an entire directory tree by just changing the top level.

Note that if you enable success auditing for everyone, your system Security log had better be freaking huge. Much better to only add it on the directories and users you're worried about.

Managing those logs once they're collected is another matter entirely. Event Viewer is the Windows built-in tool, but it's probably not adequate for trawling through lots of logging.