Announcement

Collapse
No announcement yet.

Help creating a registry that will disable creating a share (W2k3)

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Help creating a registry that will disable creating a share (W2k3)

    All,
    I am attempting to find a regisry setting that sets some flag (if possible) on a Windows 2003 server that disables the ability for anyone logged onto the server to create a share. I have even gone as far as set the permissions on LANMANSERVER\SHARES to Everyone Full DENY and still I can create a share (although it goes away at reboot.) Strange, because when I do this the share is created, but nothing shows up in the registry at all with the share name. The reason that I want to do this is because I want to create a GPO at a high level OU that stops all servers from being able to have shares created on them; then, at a lower level OU I would create a reverse GPO that would allow shares. Inside this OU I would place my file servers. All help is appreciated.
    Thanks,
    Jobie.

  • #2
    Re: Help creating a registry that will disable creating a share (W2k3)

    Hello,
    Looking at another post here with someone having the opposite problem,
    Originally posted by sam2k3 View Post
    I use windows 2003 server and have 10 computer client. I create user for login to computer client but when user login, user can't share folder. I try research about this problem but I can't. Please help.........
    Can you remove users who you wish to remove rights from from the power user and administrator groups on the servers?
    I don't know anything about (you or your) computers.
    Research/test for yourself when listening to free advice.

    Comment


    • #3
      Re: Help creating a registry that will disable creating a share (W2k3)

      I'm not really sure, but i believe there is an policy templete in Windows Server 2003 that prohibit the creation of shares. I will look into it later today.
      [Powershell]
      Start-DayDream
      Set-Location Malibu Beach
      Get-Drink
      Lay-Back
      Start-Sleep
      ....
      Wake-Up!
      Resume-Service
      Write-Warning
      [/Powershell]

      BLOG: Therealshrimp.blogspot.com

      Comment


      • #4
        Re: Help creating a registry that will disable creating a share (W2k3)

        Sorry for the late responds.
        But indeed you can.
        Look under computer configuration - Windows Settings - Local Policies - user rights asignment - Create permanent shared objects.

        By enabeling this policy, you can set who can create shared objects.
        [Powershell]
        Start-DayDream
        Set-Location Malibu Beach
        Get-Drink
        Lay-Back
        Start-Sleep
        ....
        Wake-Up!
        Resume-Service
        Write-Warning
        [/Powershell]

        BLOG: Therealshrimp.blogspot.com

        Comment


        • #5
          Re: Help creating a registry that will disable creating a share (W2k3)

          Thank you both for your research and answers. I believe Killerbe ended up finding my solution, but I've added to both of your reputations. Also, for others looking around. Check out two products along these lines...

          www.desktopstandard.com (bought by MS) which has a share manager program that will remove shares from all workstations via GPO

          www.beyondtrust.com which has a GPO ability to allow admins to remove admin rights from workstations, but still let all programs run with elevated privs.

          Comment

          Working...
          X