Administrative shares are hidden network shares created by the Windows NT family of operating systems that allow system administrators to have remote access to every disk volume on a network-connected system. These shares may not be permanently deleted but may be disabled. Administrative shares cannot be accessed by users without administrative privileges.
Administrative shares are a collection of automatically shared resources including the following:
Administrative shares have the following characteristics:
Administrative shares are not created by Windows XP Home Edition.
Administrative shares can be deleted in the same manner as any other network share, however they will be recreated automatically during the next boot cycle. To prevent access to them permanently, it is necessary to disable, rather than delete them.
Disabling administrative shares is not without caveats, though. Previous Versions for local files, a feature of Windows Vista and Windows 7 before being rebranded as File History in Windows 8 and beyond, requires administrative shares in order to function properly.
Windows XP implements "simple file sharing" (also known as "ForceGuest"), a feature that can be enabled on computers that are not part of a Windows domain. When enabled, it authenticates all incoming access requests to network shares as "Guest", a user account with very limited access rights in Windows. This effectively disables access to administrative shares.
By default, Windows Vista and later use User Account Control (UAC) to enforce security. One of UAC's features denies administrative rights to a user who accesses network shares on the local computer over a network, unless the accessing user is registered on a Windows domain or using the built in Administrator account. If not in a Windows domain it is possible to allow administrative share access to all accounts with administrative permissions by adding the LocalAccountTokenFilterPolicy value to the registry.