Tech Tip: Prevent NT users from creating new shares

Learn how to deny the ability to create new shares to everyone but administrators.

As you're probably well aware, end users who consider themselves tech-savvy are often the most dangerous. These users typically have just enough computer knowledge to make them dangerous.

In fact, it's often worth an administrator's time to take some proactive steps to lock down the network from end users. For example, what if you want to deny the ability to create new shares to everyone but administrators? That way, you could control who can access a computer from its network interface as well as the information that interface shares.

You can accomplish this with a quick registry edit. Follow these steps:

  1. To open the Registry Editor, go to Start | Run, enter regedt32 in the Open text box, and click OK.
  2. Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Shares.
  3. Select Shares and all of the folder's subkeys.
  4. Go to Security | Permissions.
  5. For the Shares folder and each of its subkeys, grant the Read permissions (at a maximum) to the Everyone group and all untrusted domains, and click OK.

Note: Editing the registry is risky, so be sure you have a verified backup before making any changes.