Disable Administrative Hidden Shares with Regedit

Administrative hidden shares, such as C$ and ADMIN$, are automatically created by Windows on system boot for remote administration. While useful in managed enterprise environments, these default shares can present a security risk if left exposed. This guide provides a straightforward method to permanently disable the automatic creation of these hidden shares on system boot by configuring the Windows Registry using Regedit.

Steps to Disable Hidden Administrative Shares

Follow these steps to modify the Windows Registry for either Windows client operating systems (Windows 10, 11) or Windows Server editions:

  1. Open Registry Editor
    • Press Win + R on your keyboard to open the Run dialog.
    • Type regedit and press Enter (or click OK).
    • Click Yes if prompted by User Account Control (UAC).
  2. Navigate to the Target Key

    • In the Registry Editor address bar, paste the following path and press Enter:

      HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters
  3. Create or Modify the Appropriate DWORD Value
    • For Windows Client OS (Windows 10 / Windows 11):
      1. Right-click on an empty space in the right pane, select New, and click DWORD (32-bit) Value.
      2. Name the new value AutoShareWks (case-sensitive).
      3. Double-click AutoShareWks, set the Value data to 0, and set the Base to Hexadecimal. Click OK.
    • For Windows Server Editions:
      1. Right-click in the right pane, select New, and click DWORD (32-bit) Value.
      2. Name the new value AutoShareServer (case-sensitive).
      3. Double-click AutoShareServer, set the Value data to 0, and set the Base to Hexadecimal. Click OK.
  4. Apply the Changes

    • Close the Registry Editor.

    • Restart your computer, or restart the Server service using an elevated Command Prompt:

      net stop server
net start server

Verifying the Changes

To ensure the hidden shares have been successfully disabled:

  1. Open Command Prompt as Administrator.
  2. Type net share and press Enter.
  3. Verify that administrative drive shares (such as C$, D$) and ADMIN$ are no longer listed. (Note: IPC$ is required for core system communication and may remain active).