Administrative Shares

A client's server (Server 2000) is not allowing workstations to view each
other or the server (workgroup environment, running Sybase driven POS
software). I checked the "Shares" folder in the Management Console on the
server, and the manually shared folders are listed, but the Administrative
shares (Admin$, C$ and IPC$) are not. I can correct the situation very
temporarily by running "Net Start IPC$", but this only lasts for less than a
minute, and then the workgroup becomes inaccessible again.

Does anyone know how this could have happened (other than intentional
sabotage) and how to correct it?

HOW TO: Restore Administrative Shares That Have Been Deleted
http://support.microsoft.com/default...b;en-us;318755

"WF Peifer" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>A client's server (Server 2000) is not allowing workstations to view each
> other or the server (workgroup environment, running Sybase driven POS
> software). I checked the "Shares" folder in the Management Console on the
> server, and the manually shared folders are listed, but the Administrative
> shares (Admin$, C$ and IPC$) are not. I can correct the situation very
> temporarily by running "Net Start IPC$", but this only lasts for less than
> a
> minute, and then the workgroup becomes inaccessible again.
>
> Does anyone know how this could have happened (other than intentional
> sabotage) and how to correct it?
>
>

"Michael Giorgio - MS MVP" <(E-Mail Removed)> wrote in
message news:(E-Mail Removed)...
>
> HOW TO: Restore Administrative Shares That Have Been Deleted
> http://support.microsoft.com/default...b;en-us;318755

Thanks for the help. Unfortunately, I tried it (both the Regedit and the
Poledit procedures) and it still drops the administrative shares within one
minute of recreating them. The POS terminals still function (using
\\servername\foldername), but I can't browse, which makes installing updates
and some other functions very difficult, racing from one end of the building
to the other before the share drops.

Hi,

I'm having the same problem. I've read that it could be a virus or worm that
has left behind a process that is deleting the shares. This is done as a
defensive measure against competing worms. I have run AV software and worm
removal tools for the likley candidates, sanned my processes for the culprit
and have had no success. I am nearly to the point of format and install. The
symptoms are exactly the same as yours. Have you had any luck since your last
posting?

Joe

"WF Peifer" wrote:

> "Michael Giorgio - MS MVP" <(E-Mail Removed)> wrote in
> message news:(E-Mail Removed)...
> >
> > HOW TO: Restore Administrative Shares That Have Been Deleted
> > http://support.microsoft.com/default...b;en-us;318755
>
> Thanks for the help. Unfortunately, I tried it (both the Regedit and the
> Poledit procedures) and it still drops the administrative shares within one
> minute of recreating them. The POS terminals still function (using
> \\servername\foldername), but I can't browse, which makes installing updates
> and some other functions very difficult, racing from one end of the building
> to the other before the share drops.
>
>
>