Why are some folders showing 'Shared' when I have disabled Sharing?

Hi all,

Asked this question before but no real answer...

Disabled the 'Server' service and the 'Workstation' service on Windows.

This supposedly disables file sharing, according to the guides I've read.

However, some folders, specifically system folders, and very important OS folders are now showing 'Shared' in their explorer.exe windows.



Does anyone know what is causing this and how to solve the problem?

The aim is to not have any folders on the machine in question made available across any networks.

You confused Windows by disabling those services so the indications you are now seeing might or might not be accurate. I'd suggest re-enabling those services at least until you have completed the procedure below.

To remove all shares, go to
Computer management, System tools, Shared folders, Shares
and delete all entries that do not have $ at the end of their ShareName.

Denis

Try3 said:

You confused Windows by disabling those services so the indications you are now seeing might or might not be accurate. I'd suggest re-enabling those services at least until you have completed the procedure below.

To remove all shares, go to
Computer management, System tools, Shared folders, Shares
and delete all entries that do not have $ at the end of their ShareName.

Denis

I'm worried I've had remote access to the machine (network-based intrusions) as some of the Windows file-security-permissions settings indicate remote account access (They're showing 'Win://<AccountName>').

External intrusion is very likely in this scenario.

Ideas as to how to isolate Windows 10 from network access..?

I know you'll say 'That's never TOTALLY POSSIBLE' but this intrusion is clearly exploiting OS functionality. There must be some straightforward manner to disable all network shares and remote (network) account logons.

By default all drives are shared with an admin hidden share with a $ ie ç$ they wònt show in explorer but from a cmd prompt net share will show them

@Samuria

I've noticed those shares reappear after a reboot. Ideas on how to make sure they stay deleted?

I hesitate to say anything at all because I do not know what effect disabling those services has had.

It is possible to end up with some strange-looking entries in Permissions for innocuous reasons. I'd suggest copying them and posting a separate question with a title such as XXXXX found in Permissions, is this normal?
- Be sure to note the folder path that the Permissions apply to and the filename/type.
- Include a snip of the Permissions list [Properties, Security, Advanced] with columns sized to show the whole thing clearly.

Your router can provide pretty good network isolation but, as you say, disconnection is the only absolute protection. I have never looked into the subject of remote working so I know almost nothing about using it or preventing it.
- There's an on/off checkbox at Control panel, System, Advanced system properties, Remote
- You could try searching the TenForums tutorials for advice on the subject

Best of luck,
Denis

@Try3

Hopefully someone will shed more light on the situation in this thread...

Bump, because this is potentially a very serious security risk.