I'm trying to impliment some registry changes to allow elevated access to the $C, IPC$, and ADMIN$ shares for Nessus scanning purposes. I've implimented the following changes:
-HKLM\software\Microsoft\Windows\CurrentVersion\Policies\System\
- EnableAccountTokenFilterPolicy 1
- LocalAccountTokenFilterPolicy 1
-Winreg permissions
- HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winreg
- Create a allow read all permission set for the winreg folder
-HKLM\System\CurrentControlSet\Services\LanmanServer\Parameters
- AutoShareServer 1
- AutoShareWks 1
I tested the changes in a lab environement and was able to good credentialed scan with the desired administrative privilieges. However, I do have some concerns before making the changes in the live environment, as the lab environment does not have end users attached to test if the changes will affect their access/normal use.
- Do I need to disconnect the old drives that are inaccessible to the admin credentials or should I run the NetShareDel funtion on those shares?
- Will disconnecting/deleting those shares have an impact to authenticated users active on the net?
- Do I have to log out/restart the domain controller for those changes to take effect, or is there any other (less disruptive) method to have those shares regenerated with the desired access?
- When the shares are regenerated after deletion/disconnection, will they still contain the same contents of the drive previously, just with adjusted permissions?
Any information would be greatly appreciated!
-Jon