Makinelerin uzaktan erişimini kapatarak Domain Admini dahil kimsenin C$, D$ yaparak makine sürücülerine erişimini engellemektedir. Landman server olarak belirtilen servisin durdurulmasıdır.
Bu alanlar regedit üzerinden düzenlenir. Eğer belirtilen parametreler yoksa isim ve değerleri ile oluşturulur.
REG ADD “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters” /f /v AutoShareWks /t REG_DWORD /d 0
REG ADD “HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters” /f /v AutoShareServer /t REG_DWORD /d 0
REG ADD “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa” /f /v restrictanonymous /t REG_DWORD /d 1@echo.Komut satırı üzerinden tek tek paylaşımlar silinir:
net share admin$ /delete
net share C$ /delete
net share D$ /delete
net share E$ /delete
net share E$ /delete net stop LanmanServer
sc config LanmanServer start= disabled
yeniden başlatıldığıda net share cmd komutu sonrasında hiçbir paylaşım sürücüsünün görünmemesi gerekmektedir.
For Workstations (Vista/Windows7)
Click Start—>Run type regedit click ok
For vista users Enter your UAC credentials to continue.
Open the HKEY_LOCAL_MACHINE branch.
Open the SYSTEM branch.
Open the CurrentControlSet branch.
Open the Services branch.
Open the LanmanServer branch.
Select the Parameters branch.
Select Edit, New, DWORD (32-bit) Value. Vista & Windows 7 adds a new value to the Parameters key (If you have the key just check for correct value).
Type AutoShareWks and press Enter. (You can leave this setting with its default value of 0.)
Restart Windows to put the new setting into effect.
I hope this work out for you this time.******************************************************************************************************************************
C:\Documents and Settings\murat>net share
Share name Resource Remark
——————————————————————————-
D$ D:\ Default share
print$ C:\WINDOWS\system32\spool\drivers
Printer Drivers
C$ C:\ Default share
M$ M:\ Default share
ADMIN$ C:\WINDOWS Remote Admin
IPC$ Remote IPC
OmniBack C:\Program Files\OmniBack\depot
SharedDocs C:\DOCUMENTS AND SETTINGS\ALL USERS\DOCUMENTS
Printer Microsoft Document Ima Spooled Microsoft Office Document Image Wr
Printer2 LPT1: Spooled HP1100
The command completed successfully.
C:\Documents and Settings\murat>net share D$ /delete
D$ was deleted successfully.
benzer şekilde tüm paylaşımlı dosyaları kaldır (IPC kalkmıyor)
regedit ten
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters
yeni DWORD key yaparak,
AutoShareWks 0
AutoShareServer 0
restart