Local Administrators and Admin Shares - C$

[John LaPrad <jrl () SVSU EDU>]

Hello all, I apologize if this is an old / resolved / basic question. I did search the archives and didn't find a good 
answer. 




Does you institution let some, or all of, their users be local administrators? 

If you do, how do you secure the admin shares like C$ from abuse? My understanding is that anyone with local admin 
rights can connect to any other computer via this share, and this ability can not be controlled with GPOs. 

I've seen mention of deleting the admin shares, but this sometimes seems to create other problems. 

I've also seen the windows 'server' service disabled as a way to secure the desktop. Seems like a good thing to do in 
any case when the users don't need to share out resources. Anyone doing this? Any repercussions? 




Thank you for your time, I appreciate all feedback. 




John LaPrad 

Saginaw Valley State University