Understanding Hidden Shares

Windows XP Professional automatically creates a number of shares for administrative purposes. These shares are not visible to network users when they search the network because they are hidden shares. A hidden share is a shared drive or folder that can only be accessed by explicitly specifying its name when accessing it. In other words, administrators can access them only if they know that the shares exist, as well as the computer where they reside and their share name.

Hidden shares are created by appending the $ character to the end of the share name. Windows XP does not indicate which drives or folders have hidden shares on the local computer (the hand does not appear under the drive or folder icon after it has been set up as a hidden share). Hidden shares can be viewed using the Shared Folders extension or snap-in. For example, Figure 19.17 shows all the hidden shares on a Windows XP Professional computer using the Shared Folders extension on the Computer Management console.

Figure 19.17: Viewing hidden shares using the Computer Management console

By default, Windows XP Professional creates a number of default hidden shares. Windows XP Professional automatically creates a hidden share for each network drive. In addition, it creates the following hidden shares:

• ADMIN$. An administrative share that points to the location of the Windows XP Professional system root (usually C:\Windows)

• IPC$. An interprocess communications share created to support remote administration over network connections

• print$. A share created to support the remote management of print devices

A UNC reference can be used to access a hidden shared from across a network. For example, to access a hidden share named D$ on a computer named DeptFileSvr, open the My Computer folder, type //DeptFileSvr/D$ in the Address field, and press Enter. Like other network files, access to hidden files is governed by share and NTFS file permissions, as explained in the following section.