RE: SPM2000$ Rouge Share

[Harlan Carvey <keydet89 () yahoo com>]

Jon,
 
> If I go to the management console> shared folders>
> shares> Right-click and
> properties> I get the following:
>
> "This has been shared for administrative purposes.
> The share permissions and file security cannot be
set."
>

When I got into that same interface, I see a column
next to the shared folder called "Path".  What does it
say in the case of this SPM2000$ share?

When you see the dialogue box you describe above, and
click on "Ok", you should see a Properties dialogue
box.  Is there any information there, perhaps under
Path or Comment, that might be of use?  
 
What other shares are available in the main console
window?  Are there any sessions or open files?

> However, I'm not able to reboot the server at this
> time as it's currently in
> production, so the reoccurrence of the share is
> simply an assumption.

Okay, just wanted to be clear on that.  It's important
to separate assumptions from facts when dealing w/
incidents.
 
> I'd just like to know why this share exists.

Okay, that's a little different from what your
original post stated.

Without knowing more about what applications are
installed, or have been installed and since removed,
it's kind of hard to tell.  Maybe someone out there
will have seen this exact issue before, and be able to
answer authoritatively and accurately.  Aside from
that, though, w/o knowing more about how the systems
are set up and following basic troubleshooting
procedures, anything else you get from the list is
likely to be speculation.

Have you looked into the issue any further?   

Harlan


__________________________________________________
Do you Yahoo!?
Yahoo! Platinum - Watch CBS' NCAA March Madness, live on your desktop!
http://platinum.yahoo.com

----------------------------------------------------------------------------

<Pre>Lose another weekend managing your IDS?
Take back your personal time.
15-day free trial of StillSecure Border Guard.</Pre>
<A href="http://www.securityfocus.com/stillsecure";> http://www.securityfocus.com/stillsecure </A>