Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To stop Windows from automatically creating drive-root shares such as C$ and the ADMIN$ share, set the appropriate registry value to 0, restart the Server service, and verify with net share.
- Windows Server:
AutoShareServer - Windows client/workstation:
AutoShareWks
This setting does not remove IPC$, manually created shares, or domain-controller shares such as NETLOGON and SYSVOL. Microsoft documents the procedure in its administrative-share guidance.
What Windows “default admin shares” are
When the Windows Server service (LanmanServer) runs, Windows normally creates hidden administrative resources. They are intended for authenticated administrators, management software, backup tools, deployment systems, and troubleshooting—not for anonymous access.
| Share | Typical purpose | Covered by AutoShareServer/AutoShareWks? |
|---|---|---|
C$, D$, and other drive shares |
Remote access to volume roots | Yes |
ADMIN$ |
Remote administration through the Windows directory | Yes |
IPC$ |
Named pipes and interprocess communication | No |
NETLOGON and SYSVOL |
Domain-controller logon and Group Policy services | Not ordinary drive admin shares |
| Manually created shares | Application or user file sharing | No |
Deleting a share with net share name /delete is not a durable solution: the Server service can recreate automatic shares. The registry setting controls whether Windows creates them when the service starts.
#1 Best Overall
Should you disable them?
First decide whether your problem is creation or access. Disabling automatic shares addresses creation. It does not disable SMB, remove local administrator rights, stop WinRM, block Remote Desktop, or prevent a program from creating another share.
| Situation | Usually better approach |
|---|---|
| Isolated, hardened server with another management channel | Consider disabling after a compatibility test |
| Domain workstation fleet | Use scoped Group Policy or MDM, with a pilot group |
| Deployment, backup, monitoring, or support tools use SMB admin paths | Keep the shares and restrict SMB access by firewall and network scope |
| Domain controller | Do not apply blindly; preserve and validate domain-service shares |
| Shares disappeared unexpectedly | Investigate service configuration, policy, startup software, and possible compromise |
Administrative shares require authentication and appropriate privileges. Their presence alone does not prove that an attacker can use them. Review local-admin membership, credential reuse, SMB exposure, segmentation, signing/encryption, NTLM controls, and endpoint telemetry. Disabling the shares can reduce one lateral-movement path, but it is not a complete ransomware or SMB-security strategy. Mandiant describes it as one possible containment measure, not a standalone defense (Mandiant guidance).
Before changing a computer
- Confirm whether it is a server, workstation, or domain controller.
- Inventory software that may copy files through
ADMIN$,C$, orIPC$. - Confirm a recovery path such as console access, PowerShell remoting, Windows Admin Center, or an endpoint-management agent.
- Back up the registry or export
HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters. Incorrect registry edits can cause serious problems. - Pilot the change on a small, representative group before broad deployment.
Method 1: Registry Editor
- Sign in with administrative rights and open Registry Editor (
regedit.exe). - Go to
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesLanmanServerParameters. - Create or edit a REG_DWORD (32-bit) value:
- Windows Server:
AutoShareServer - Windows client/workstation:
AutoShareWks
- Windows Server:
- Set its value data to
0. - Restart the Server service using one of the methods below.
If the value is absent, Windows uses its normal behavior and creates automatic shares. Do not create both values indiscriminately; use the one matching the operating-system role.
Method 2: Command Prompt
Windows Server
reg add "HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters" ^
/v AutoShareServer /t REG_DWORD /d 0 /f
net stop server
net start server
net shareWindows client or workstation
reg add "HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters" ^
/v AutoShareWks /t REG_DWORD /d 0 /f
net stop server
net start server
net shareRun Command Prompt as administrator. Stopping the Server service can interrupt active SMB sessions, so schedule the change appropriately.
Method 3: PowerShell
Windows Server
New-Item -Path 'HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters' -Force | Out-Null
New-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetServicesLanmanServerParameters' -Name 'AutoShareServer' -PropertyType DWord -Value 0 -Force | Out-Null
Restart-Service -Name LanmanServer -Force
Get-SmbShareOn a workstation, replace AutoShareServer with AutoShareWks. This is a PowerShell implementation of Microsoft’s documented registry setting.
Deploying the setting centrally
Active Directory Group Policy
In a domain, use the relevant Microsoft security-template setting rather than editing every computer:
- MSS: (AutoShareServer) Enable administrative shares
- MSS: (AutoShareWks) Enable administrative shares
Names can vary with administrative-template versions and locale. Configure the matching policy to disable automatic shares, link it to a test OU, and verify the effective registry value and application dependencies before expanding the scope. Use gpresult /h gp.html to investigate policy results and overwrites.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIntune or another MDM
For supported, cloud-managed Windows workstations, Microsoft documents the device-scoped ADMX-backed setting:
./Device/Vendor/MSFT/Policy/Config/ADMX_MSS-legacy/Pol_MSS_AutoShareWksValidate the enabled/disabled semantics in your tenant because the policy wording describes the default behavior. Microsoft’s documented support covers specified Windows 10 and Windows 11 releases; check the current CSP documentation before deployment. Intune’s Devices > Manage devices > Group Policy analytics can help analyze an existing GPO during migration (Microsoft’s guide). A remediation script that writes the correct DWORD is another option when policy support or reporting is insufficient.
Verify the result
On the computer, run:
net shareor:
Get-SmbShareThen, from an authorized management host, test the specific paths:
Rank #3
dir \COMPUTERNAMEC$
dir \COMPUTERNAMEADMIN$After a successful change, the relevant automatic shares should not be listed and should not be available because they were not created. IPC$ may still appear. Manually created shares and domain-service shares may also remain; that is expected.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Check the value and type if results are unexpected:
reg query "HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters" /v AutoShareServerUse AutoShareWks in the query on a workstation. The output should identify a REG_DWORD with data 0x0.
Common problems
- Wrong value:
AutoShareWkson a server orAutoShareServeron a workstation will not control the intended role. - Wrong type: A string value named
AutoShareServeris not equivalent to a DWORD. - No service restart: Restart
LanmanServeror reboot before judging the result. - Shares return after policy refresh: A GPO, MDM remediation, startup script, deployment agent, or security product may be restoring the setting. Check
gpresultand the registry after refresh. IPC$remains: This is expected; the AutoShare values do not remove it.- Management breaks: Restore the share or use an approved alternative channel after identifying the dependency.
Restore automatic shares
To return to normal behavior, set the applicable value to 1 and restart the Server service. Removing the value also returns Windows to its default automatic-creation behavior.
reg add "HKLMSYSTEMCurrentControlSetServicesLanmanServerParameters" ^
/v AutoShareServer /t REG_DWORD /d 1 /f
net stop server
net start server
net shareUse AutoShareWks instead on a workstation. Microsoft’s missing-share guidance documents this restoration behavior.
If the shares vanished unexpectedly
Do not assume that malware is the only explanation, but treat unexplained disappearance as an investigation trigger. Check the Server service, registry changes, effective Group Policy or MDM settings, startup programs, security-product actions, and relevant event and authentication logs. Microsoft notes that missing administrative shares can reflect a system problem or malicious software.
Safer alternatives to blanket disabling
- Restrict inbound SMB (especially TCP 445) to approved management networks and hosts.
- Use network segmentation and separate administrative accounts.
- Reduce local-administrator membership and eliminate shared passwords.
- Require SMB signing or encryption where compatible, and restrict legacy NTLM after testing.
- Use controlled PowerShell remoting, Windows Admin Center, MDM, or an authenticated management agent.
- Disable automatic shares only on selected device groups while retaining them where backup or deployment workflows require them.
The registry change is free. Group Policy is generally the natural choice for traditional Active Directory environments; Intune is an optional fleet-management route for organizations already using cloud MDM. Neither replaces compatibility testing or broader SMB hardening.
Frequently Asked Questions
Does this disable IPC$?
No. Microsoft’s AutoShareServer and AutoShareWks settings do not remove IPC$.
Does it disable all SMB or manually created shares?
No. SMB remains available, and manually created shares are unaffected.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Should I apply this to a domain controller?
Do not apply it blindly. Validate NETLOGON, SYSVOL, replication, and every management dependency first.
Best Value
Do I need to reboot?
A reboot works, but restarting the Server (LanmanServer) service is the targeted documented action.
Why did the shares come back?
Check that the correct DWORD is set to 0 and that Group Policy, MDM, scripts, or management software are not overwriting it.
How do I restore them?
Set the relevant value to 1 or remove it, restart the Server service, and verify with net share.
The Bottom Line
Use AutoShareServer=0 on Windows Server or AutoShareWks=0 on a workstation, restart LanmanServer, and verify with net share. Treat this as one narrowly scoped hardening measure—not a substitute for SMB access controls, least privilege, and tested management alternatives.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
