Unable to access Administrative Shares on a Windows 7
Hi all,I'm a bit annoyed by this.I have set up 2 EXACTELY identical laptops using Windows 7 Professional.Both are integrated in my AD.On one, I can remotely access administrative shares.On the other one, I cannot access anything.On both : - File and printer sharing is turned on for the Domain profile. - Network discovery is turned on for the Domain profile. - Firewall is deactivated for Domain profile.I have tried the famous LocalAccountTokenFilterPolicy key on the one that I cannot access and it doesn't change anything.Being unable to access this administrative share is preventing me from deploying my antivirus and other software.Can someone point me in the right direction to solve this problem please ?ThanksPS : I don't want to share my drive at all (I know how to do this), I just need to access the Administrative Shares.
February 4th, 2010 11:23am

Hi, Firstly, please let us know the exact message you received of the accessing failure and the operating system of the computer which hosts the share. Based on my research, I would like to suggest the following: 1. Check if you can ping the computer which hosts the share you want to access. 2. Check the security and permission settings of the shares and ensure the user on the problematic computer have the permission to access the share. Thanks. Nicholas Li - MSFT
Free Windows Admin Tool Kit Click here and download it now
February 9th, 2010 3:51pm

Thanks for this reply :When I'm trying to \\totocomputer\c$, I get this error message : Error code: 0x80070035, The network path was not found.When I'm trying a net view \\totocomputer, I get this error message : System error 53 has occurred. The network path was not found.1) I can perfectly ping totocomputerP:\>ping totocomputer Pinging totocomputer.xxxxxxxx.priv [10.33.xx.xxx] with 32 bytes of data:Reply from 10.33.xx.xxx: bytes=32 time<1ms TTL=128Reply from 10.33.xx.xxx: bytes=32 time<1ms TTL=128Reply from 10.33.xx.xxx: bytes=32 time<1ms TTL=128Reply from 10.33.xx.xxx: bytes=32 time=1ms TTL=128Ping statistics for 10.33.xx.xxxx: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms2) I cannot check the security and permission settings on an administrative share.... unless you have a way that I don't know of.3) If I type net share in a DOS command box on totocomputer, it gives me a valid answer :C:\>net share Share name Resource Remark -------------------------------------------------------------------------------ADMIN$ C:\Windows Remote AdminC$ C:\ Default shareD$ D:\ Default shareIPC$ Remote IPCY$ Y:\ Default shareZ$ Z:\ Default shareThe command completed successfully. C:\>Hope you can help meThanks in advance
February 10th, 2010 11:00am

Hi, Thank you for your update. I still would like to know the operating system of the computer which hosts the share. At this time, please also try the following: 1. Please check if you can access the share with “\\<IP Address>\folder”. 2. Enable NetBIOS over TCP/IP in Windows 7: 1) Go to “Control Panel\Network and Internet\Network Connections”. 2) Right-Click on the connection and choose Properties. 3) Click “Internet Protocol (TCP/IP) Version 4” in the list. 4) Click Properties, and then click Advanced. 5) On the Advanced TCP/IP settings windows, go to “WINS” tab. 6) Under NetBIOS setting, click “Enable NetBIOS over TCP/IP”, and then click OK. 3. Temporarily disable or remove all the security software (firewall, anti-virus, anti-spyware, etc.) on the computer and check if it works. 4. Boot this computer to clean boot and check the issue: How to troubleshoot a problem by performing a clean boot in Windows Vista or in Windows 7 5. Please also check if this computer can access some other shares on the network. Hope this helps. Thanks. Nicholas Li - MSFT
Free Windows Admin Tool Kit Click here and download it now
February 10th, 2010 1:25pm

Hi,As told in the first post : Operating System is Windows 7 Professional x86.1) The \\<IP Address>\Share doesn't change anything to the problem.2) NetBIOS over TCP/IP is enabled by the DHCP but I have forced it to check and it doesn't change anything.3) I have disabled Windows Defender and there's no Antivirus installed. The firewall is disabled in the Domain profile (which is the connected profile).4) I'll check5) This computer can access the other shares on any computer in the domain.Thanks
February 11th, 2010 12:14pm

You can Turn off UAC. It is User Account Control that is stopping the admin$ shares. It is VERY annoying so I disable it in a network environment.I tested what you wrote and with UAC on default settings, I cannot access admin shares, but with it off I can.If you want UAC on you can do the TokenFilter key like you did but the trick is you THEN have to share any drive on the machine. Doesn't matter which one. Just share it and then check the share. Then check the $ shares.Eg. Share C as C. Check the \\workstation\c and then check \\workstation\c$ and \\workstation\admin$ They all should work.Now you can turn delete the C share and the $ shares will still work =)Oh and I like the Group Policy Setting - Computer Config-Windows Settings-Security Settings- Local Policies - Security Options - Run All Administrators in Admin Approval Mode - DISABLED (it is enabled by default). lforbes
Free Windows Admin Tool Kit Click here and download it now
February 18th, 2010 1:49am

Hi,Thanks for your reply but :1) Turning off UAC doesn't change my problem2) The TokenFilter is installed but I don't see any changes.3) I have set the group policy as suggested but it doesn't help also.Thanks anyway
February 24th, 2010 9:47am

Hi, Thank you for your update. At this time, I would like to share the following with you: File and Printer Sharing in Windows Vista Please Note the section “Administrative Shares and Sharing the Root of a Drive” Hope this helps. Thanks. Nicholas Li - MSFT
Free Windows Admin Tool Kit Click here and download it now
February 26th, 2010 8:50am

Is it or are they connected to a "Homegroup" If home group is selected on one and it is on a regular netwwork you can see out but not in.
February 27th, 2010 11:52pm

I have the same problem: I have two machines running Windows 7 Professional, and on one I can see the admin shares but not on the other. I read the TechNet article that Nicholas posted, but all it says about admin shares is when the computer is in a workgroup they are disabled for security reasons. Nothing else. I've tried the registry fix, removing the non-working machine from its HomeGroup, but nothing has worked. The machine where I can see the admin shares is a laptop and I didn't do anything special to it to get the shares to work. It was originally in a HomeGroup, didn't have the registry fix, etc. So it seems to be possible to enable the shares via some combination of settings. The question is, what is that series of steps that make them work? Chris
Free Windows Admin Tool Kit Click here and download it now
February 28th, 2010 3:25am

Hi,Thanks for your reply but :1) Turning off UAC doesn't change my problem2) The TokenFilter is installed but I don't see any changes.3) I have set the group policy as suggested but it doesn't help also.Thanks anyway Did you try just sharing another drive and seeing if that kicks it. I am in a domain so we don't have homegroups. lforbes
February 28th, 2010 10:31pm

Hi, Thank you for your update. At this time, I would like to share the following with you: File and Printer Sharing in Windows Vista Please Note the section “Administrative Shares and Sharing the Root of a Drive” Hope this helps. Thanks. Nicholas Li - MSFT Can you please explain what part of this, answers the OP's question? I read that link and while interesting it doesn't explain at all the solution to this problem. We are in a Domain environment and File and Print sharing is enabled and the admin shares are not accessible without the hacks I showed. Also this is 7 not Vista. This link only says to share the drive as something else? That is not a solution to the problem posted. Anyone can share a drive. We need access to the administrative shares ONLY so that we don't have to set them up manually (on thousands of workstations).I understand the need to mark the "correct" answer but in cases when the answer marked "correct" isn't an actual answer it gets confusing for any new readers who will no doubt be searching for a real solution to this issue. lforbes
Free Windows Admin Tool Kit Click here and download it now
March 10th, 2010 8:45pm

Hi everyone,You are totally right Iforbes, I don't know who marked this as an answer but I didn't... or I did a false manipulation. I unmarked it.Until now, I still don't have any answer to my problem.I have reinstalled the computer using Windows 7 Enterprise and now, I can access the administrative shares on every computer I have reinstalled.Can it be a Windows 7 Pro specific problem ?All I know is that :- I never activated HomeGroup- I deactivated the firewall right from start- I didn't install any antivirus- I deactivated Windows DefenderI really cannot explain what happened and cannot reproduce this on Windows 7 Enterprise.Thanks anywayEDIT: Iforbes, I haven't tried but will do it tomorrow and let you know if I can share a drive
March 11th, 2010 1:00am

There is something wrong with your installation which is causing this problem. Vista/7 Professional need the LocalAccountTokenFilterPolicy registry fix to enable administrative shares in Workgroup mode. I don't know whether its required in domain mode as well because I did the registry fix before joining a domain. The HomeGroup services are explicitly disabled and Password Protected sharing is enabled in the network settings. I have also disabled Use Sharing Wizard from Explorer > Folder Options menu. In XP it was called Use Simple Sharing and leaving this checked DISABLES administrative shares on XP. I don't know if it also disables administrative shares on Vista/7.
Free Windows Admin Tool Kit Click here and download it now
April 2nd, 2010 2:21pm

Hi, I am having exactly the same problem on a Windows 2003 SBE domain based server, the workstations are windows XP with SP3. I'm also trying to access the hidden shares for the purposes of pushing a corporate anti-virus (sophos security) to all of the workstations. I tried to set it up at my clients with no luck what so whatever - I type \\server1\c$ and i'm asked for a username and password. I tried the relevent user name of domain user on the workstation with no success - there is no error msg but the pasword screen re-appears blank usually inidcating an invalid username and password - i then try the adminstrators username and password and i am told that i cannot access the share using multiple usernames and passwors - disconnect all previous connections.....blah blah blah.. I removed the share and added it back immediatly where it would give me the option to set permissions and security so i set up the specific user with full access to everything and still no go (that would not have been ideal anyway), however i'm skeptical as to whether Windows set the permissions or not or whether they just defualt back to the normal settings when the share is recreated - no way of checking i don't think Upon further investigation i went back to my workshop and attempted to access the administrators share on my own domain and found the same issues. i removed my shared drives and deleted my network passwords and i could then access the hidden share on the server. however after logging out and in and remapping those network drives i was back to square one. I'm about to try some of the solutions suggested - setting tokenfilter etc. i don't really have much more input to add but that is my experience with it so far and so it might help somoene else. After spending sometime on the phone to Sophos trying to sort it out they told me it is a windows networking problem and their software is designed to utilise that environment - i have a gut feeling that Microsoft has a security somewhere along the line that changes the way the default share works both of the networks i am working are not complicated they were given a basic set up with no real specific GP's. i am starting to think i'll also try installing a serve edition on a spare computer and don't do any updates to see if there are any differences there - that's a lot of work for not much chop tho.
April 29th, 2010 7:07am

Had the same issue this morning. Turns out the user had unticked "File and Printer Sharing for Microsoft Networks" in the NIC properties. It was the last thing I expected to be disabled so, naturally, it was the last thing I checked. Cheers
Free Windows Admin Tool Kit Click here and download it now
May 11th, 2010 4:00pm

Had the same issue this morning. Turns out the user had unticked "File and Printer Sharing for Microsoft Networks" in the NIC properties. It was the last thing I expected to be disabled so, naturally, it was the last thing I checked. Cheers With Windows 7 this is disabled by default which is one of the causes of the problem. There is no way I know of to turn it on at the Domain Controllerlforbes
May 11th, 2010 8:14pm

Was there ever an answer to this question?
Free Windows Admin Tool Kit Click here and download it now
July 30th, 2010 4:03am

After spending a week with the same issue, i found the solution that works for me. I have 2 Windows Ultimate 32 Bit in my home network, one laptop and a desktop machine. Access the admin shares on the older installation on my laptop works perfectly from every other computer in my network. However, i was not able to access the new installed Windows 7 on the desktop machine. I have tried the LocalAccountToken fix and some other tips belong to firewall settings, etc. Non of them works at all, i just remember that the only difference between the installations was that this time i immediately leave and disable the Homegroup after installation finished. So i compared with the laptop and take a look at all related settings, and there it was: Computer Management, Shares - no adminstrative shares at the fresh installation. I added them manually for each drive with the drive letter plus the $ sign (that not works in explorer) and thats it. Now i can access the admin shares on both machines with the same behavior as expected. It looks like leaving the homegroup removes the admin shares, but i'm not sure as i don't take a look before.
August 11th, 2010 11:28am

my last post was not the whole truth as i have to notice. Adding the shares manually works, but only until the next reboot. The standard setting of Window 7 is NOT to recreate the admin shares at every startup. So i found that set the registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\LanmanServer\Parameters\AutoShareWks=1 (from its default value AutoShareWks=0) finally did the magic. I have also set the LocalAccountTokenFilterPolicy=1 still love Windows 7...
Free Windows Admin Tool Kit Click here and download it now
August 15th, 2010 3:56pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics