Removing Hidden System Shares

Contents

• Introduction
• The Net Command (net.exe)
• Starting Net Command
• Listing Current Shares
• Sharing a Resource
• Removing a Share
• Net Command Help

Introduction

Although, Windows helps you in managing system shares via a great deal of tools and applications, it creates hidden shares for all your disk drives after you install a new fresh copy of Windows that are hidden and not accessible via these tools.

What does “hidden” means? It means that these shares are neither shown to the user nor marked with the sharing mark in Windows Explorer. Plus, they are not accessible via common tools like Computer Management MMC snap-in. Instead, you can control those shares only via command-line instructions. These shares are also hidden from other computers in the network. However, other users can access your computer via these shares using very simple instructions.

Why keeping these shares are considered very dangerous? Imagine what if some user in the network accesses your disk drives by writing a simple line like \\<Your-Computer-Name>\C$ (to access the C: drive) in the Run utility (in the Start menu.) At least, he can steal your personal information and data and expose them to danger.

The Net Command (net.exe)

Windows comes with a very nice utility, Net Command (net.exe) that is used for many purposes. We are not going to cover all uses of Net Command since it requires plenty of articles, not one! Instead, we are going to talk about only one use of the Net Command; it is the Sharing Manager.

Starting the Net Command

Unfortunately, Net Command utility does not include a GUI (Graphical User Interface). Thus, we will have to use the Command Prompt when working with Net Command (net.exe).

Follow these steps to start Command Prompt:

1. Open the Start Menu
2. Choose Run
3. Type “cmd” in Run dialog box
4. Click OK button

Listing Current Shares

After running the Command Prompt, you can type this command to list the current system shares:

net share

The previous command should display something like that:

Share name   Resource                        Remark

------------------------------------------------------------
d$           d:\                             Default share
e$           e:\                             Default share
f$           f:\                             Default share
IPC$                                         Remote IPC
print$       C:\Windows\system32\spool\drivers
                                             Printer Drivers
C$           C:\                             Default share
Programs     D:\Programs
The command completed successfully.

The display is divided into three columns, Share Name, Resource, and Remark. Share Name displays the name of the share that is visible to the user. Every share has a unique name and you can control a share only using that name. Resource column shows the path of the share. Remark shows some comments - which you can set manually - about the share.

The previous results from my machine show that all my drives, C, D, E, and F, are currently shared as hidden. They are named c$, d$, e$, and f$ respectively. That’s the default naming convention used by Windows for hidden disk shares. In addition, the results show that I have shared the D:\Programs directory.

Sharing a Resource

To share a new resource (e.g. directory), you can use the following line:

net share =

Replace <ShareName> with the name of the new share and <Path> with the resource path. Again, share name should be unique or the operation would fail.

The following line shares the D:\Products directory as the name Products (you may change the path to any other path that exists in your machine):

net share Products=D:\Products

Now, D:\Products is shared successfully. Notice that it’s a normal share, not hidden.

Consider the following line:

net share "Hot Songs"="D:\My Songs" /REMARK:"My Favorite Songs"

The previous line shares “D:\My Songs” as the name “Hot Songs” (as it would appear in Windows Explorer.) In addition, it sets a remark “My Favorite Songs” that would be shown when you list the shared resources as we did in the previous section.

Note that you can control share ACLs (Access Control Lists) using switches like /GRANT. See the last section.

Removing a Share

Now, it is time for removing shares that we don’t need. The following line removes the hidden share of C drive. Notice that we are referring to the share by its name.

net share C$ /d

The following line is the same:

net share c$ /delete

The following line removes the “Hot Songs” share that we have shared in the previous section:

net share "hot songs" /d

Notice that share name is case-insensitive.

Net Command Help

If you want to discover other features of Net Command or you want to display a command help, just add the /? switch to the end of the command. Consider the following line:

net share /?

It shows the help of the sharing command of the Net Command:

The syntax of this command is:

NET SHARE
sharename
 sharename=drive:path [/GRANT:user,[READ | CHANGE | FULL]]
                      [/USERS:number | /UNLIMITED]
                      [/REMARK:"text"]
                      [/CACHE:Manual | Documents| Programs | None ]
 sharename [/USERS:number | /UNLIMITED]
           [/REMARK:"text"]
           [/CACHE:Manual | Documents | Programs | None]
 {sharename | devicename | drive:path} /DELETE

Cool, ain’t it?