Disable C$ and ADMIN$ Shares Using Regedit

Windows automatically creates hidden administrative shares, such as C$ and ADMIN$, for remote management and troubleshooting across a local network. While useful in enterprise environments, leaving these default shares active can pose a security risk on non-managed networks. This guide explains how to permanently disable administrative shares in Windows by configuring the system registry via the Registry Editor (regedit).

Step 1: Open the Registry Editor

  1. Press Win + R on your keyboard to open the Run dialog box.
  2. Type regedit and press Enter (or click OK).
  3. If prompted by User Account Control (UAC), click Yes to grant administrative permissions.

Step 2: Navigate to the LanmanServer Key

In the Registry Editor, use the left-hand navigation pane to browse to the following path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters

Step 3: Create and Configure the Registry Value

Depending on whether you are running a Windows client edition (Windows 10 or 11) or Windows Server, create the appropriate DWORD value:

For Windows 10 / Windows 11 (Workstation)

  1. Right-click on an empty area in the right pane.
  2. Select New > DWORD (32-bit) Value.
  3. Name the new value AutoShareWks.
  4. Double-click AutoShareWks, set the Value data to 0, and ensure the Base is set to Hexadecimal.
  5. Click OK.

For Windows Server

  1. Right-click on an empty area in the right pane.
  2. Select New > DWORD (32-bit) Value.
  3. Name the new value AutoShareServer.
  4. Double-click AutoShareServer, set the Value data to 0, and ensure the Base is set to Hexadecimal.
  5. Click OK.

Step 4: Apply Changes

To apply the changes, the Server service must be restarted, or the computer must be rebooted.

Option A: Restart via Command Prompt (Admin)

Run the following commands in an elevated Command Prompt:

net stop server
net start server

Option B: Restart the Computer

Restart your PC or server normally to ensure all administrative shares are removed.

Step 5: Verify the Changes

To verify that the administrative shares have been disabled:

  1. Open Command Prompt.

  2. Type the following command and press Enter:

    net share

  3. Check the list of active shares. Administrative shares such as C$, D$, and ADMIN$ should no longer be listed (the IPC$ share may remain active as it is required for local system operations).