Hiding Sysvol and Netlogon shares?

[fox1977]

Hi there,

 

Is it possible to hide the sysvol and netlogon shares on our windows domain network?

 

We have a windows domain on a subnet and another standalone server on the same subnet that will be managed by someone else. I am just carrying out some tests and from the standalone server and they are able to browse the shares and write files to the sysvol share!!

 

Is there anyway i can secure these two shares? is it possible to put a $ on the end of the share to hide it?

 

Anyone any ideas on what is possible? I don't want to come in one day to find that the domain has gone down because someone has messed up the sysvol share!

 

Thanks

[DMcCoy]

The only way they could write to the sysvol share is if the username/password is the same as an existing user with permissions to write.

 

Do NOT alter the shares, many things will break.

[fox1977]

The odd thing is the standalone server - under an admin account - can write to the sysvol share. SUrely this isn't correct?

[Ric_]

The odd thing is the standalone server - under an admin account - can write to the sysvol share. SUrely this isn't correct?

 

I've noticed odd things like this if the username/password combinations are the same on each machine.

[fox1977]

Possibly. I might try with a different username and pw combination later.

[mjs_mjs]

I've noticed odd things like this if the username/password combinations are the same on each machine.

 

I've seen this many times. I think it's something to do with kerbros auth.

 

The system volume sysvol and netlogon shares are shares sharing files required for computers on the domain. The shares contains group policies, packages and scripts i think. You WILL break windows if you remove the shares.

[Michael]

As mentioned above, I wouldn't look at the shares as the problem, but the users and their access rights. In theory all users require read access to these shares in some form anyway to process logon scripts and GPOs. I wouldn't change anything on either of these shares!

[plexer]

Your domain will cease to function properly if you mess with either of those shares, the username/password combo used to logon to the member server must be the same as some domain credentials that have write access to sysvol and netlogon.

 

Ben

[fox1977]

The seperate server i am trying to access them from use to be part of the domain. It looks like i have the same admin user locally as my domain admin account and possible something to do with cached credentials or something weird with kerbos.

 

When I create a new local admin users I cannot see anything and things are fine!

[Cools]

Does the standalone server have the same username and password as the other server that you are accessing SYSVOL folder on? if so change the standalone username and password.

 

you can hide the servers by turning off netbios i did.. all works fine still.

[plexer]

Isn't that exactly what he said the problem was in the post above yours Cools?

 

Ben

[mjs_mjs]

As i understand it;

 

When you auth using kerberos the machine creates a ticket, and the server has a matching ticket. The tickets are stored on the machines for a set period of time. The ticket is generated using the username, password and computer name i think, so changing one of these means the tickets are no longer valid.

 

A key point i should make is you do not have to be part of a domain or on a domain to auth using kerberos. Anyone can, but it's the sharing and NTFS properties ''security'' that tie's down which users/attempts are allowed access.