Disabling access to Administrative Shares (c$)

I strongly recommend doing everything possible to avoid giving local administrator rights to users, it should be the absolute last resort, and can be avoided 99% of the time. What do you mean though by them remotely connecting to other computers? This will not be possible except to their own workstations, you're not giving them domain admin rights, or using a common/shared local Administrator password in every machine, right? RIGHT? :)

Even if you disable the admin shares, if your users have local admin rights, whats stopping them from creating new shares?

I agree with CoccoBill you usually can do things in XP to give users access to everything they need without giving them more than user rights.

Do these users have Admin rights to the AD domain?  If so STOP!!!!!!!!

If not then you are assigning them local admin rights to the local machine which means they won't have admin rights across the network.

To do this go to the local machine they need Admin rights for and go to the local admins group or necessary group and add their ad username (domain/username).  This will give them Admin rights only to the local machine not the entire network.  If you are giving everyone Domain Admin rights then you are in for a mess of trouble.

Also assign the NTFS deny right to the share for the users you don't want in.  This will appear to them that they can't get in then.  

From Windows 2000 help:

Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000 security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a User can run in Windows NT 4.0, a Power User can run in Windows 2000.

Power Users can:

Run legacy applications in addition to Windows 2000 certified applications.
Install programs that do not modify operating system files or install system services.
Customize system-wide resources including Printers, Date/Time, Power Options, and other Control Panel resources.
Create and manage local user accounts and groups.
Stop and start system services which are not started by default.
Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.

If a user has local admin rights to their machine, that means they have full control over their own particular machine.  If Joe Sixpack sits down at his machine, "Machine A" and logs in as himself, "Joe6" he has full control over his machine.  Joe Sixpack does NOT have admin rights to the network, or the domain, only over his own personal machine.

Now, because he has local admin rights over his own personal machine, if he were to sit down at Jane Doe's machine, and logs in as himself; "Joe6" he would have admin rights over that particular machine as well.  He'd have full access to every directory on Jane Doe's machine.

(For the purpose of this example, lets presume that the IP address of Janes machine is 192.168.1.25.)

Therefore, by extension, if Joe Sixpack is sitting at his desk and he decides he wants to see Jane's entire hard drive, all he has to do is go into network neighborhood and type the following: \\192.168.1.25\c$ and he'll be able to pull up the Jane's entire hard drive because windows security presumes that because he has local admin rights on his local pc, that if he were to log into Jane's machine as himself he'd be able to see her entire hard drive anyway, so why not just let Joe view Janes entire hard drive over the network simply by browsing the to the "hidden" share.

We need to be able to have Joe sixpack and Jane Doe to have local admin rights without allowing them to browse each others hidden share.  READ: HIDDEN SHARES!  That means shares that are automatically created by Windows 2000 that are hidden.

If what I've said here is over your head, then don't bother offering a response. If you tell me to remove local admin rights; you'll be in grave danger of losing your manhood. That option is NOT on the table.  

I am NOT talking about sharing folders on a person's machine... I'm talking about the default hidden share that MS creates (c$)... If you don't know what I'm talking about then go to your own machine, open network neighborhood or your IE browser and type \\127.0.0.1\c$ and you'll see your entire C:\ drive just as though you were viewing it locally, however, you'll be looking at your own c drive through your own TCP/IP stack.

My question is: How do we stop Joe Sixpack from being able to pull up Jane's private hidden share without having to remove local admin rights.

jrhelgeson, your presumption above is incorrect.

"Now, because he has local admin rights over his own personal machine, if he were to sit down at Jane Doe's machine, and logs in as himself; "Joe6" he would have admin rights over that particular machine as well.  He'd have full access to every directory on Jane Doe's machine."

Not at all the case.  If Joe6 (a domain account) is a local administrator on Machine A, he has admin rights to Machine A.  The local Administrators group belongs to the *computer,* not to the logged-in user, so if Joe6 logs into Machine B, where he is not a member of the local administrators group, then he doesn't have admin rights.

So, therefore by extension, if Joe6 logs into Machine A, and Machine B's IP is 192.168.1.25, and he enters \\192.168.1.25\c$ - he gets access denied.

The answer to your question, based on the evidence you've provided, is that Joe6 already cannot pull up an administrative share on someone else's computer.

*If he can* -- then he's a member of the local admins group on the other machine, either individually or as a member of a group which has been added.

Ok, the issue here is that Joe6 *can* pull up Jane's entire C drive as was described above by typing \\192.168.1.25\c$
.
I realize that disabling the private share as PeteLong suggested is a viable solution. I'm just looking how to disable the ability through AD or group policy.

Also here is a couple more solutions.
Remove TCP/IP
Disable the network card
pull the network card from the machines.
Remove the cat5e cable

put a firewall on each machine prevent all incoming traffic.
Disable file and print sharing.

http://www.experts-exchange.com/Security/Win_Security/Q_21245848.html
Method 1: Deleting default administrative shares for the current session only
To delete a hidden administrative share for the current session only, follow these steps:
1.      In Control Panel, double-click Administrative Tools, and then double-click Computer Management.
2.      Expand Shared Folders, and then click Shares.
3.      In the Shared Folder column, right-click the share that you want to delete, click Stop sharing, and then click OK.
Method 2: Deleting default administrative shares for current and later sessions
Warning If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

To delete the hidden administrative shares for all root partitions and volumes (such as C$) and the system root folder (ADMIN$) and to prevent Windows from re-creating them, add an AutoShareWks DWORD value to the following registry key, and then set its value data to 0:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters