How can I list hidden administrative shares using PowerShell?
I'm trying to write a script that will audit shared folders on a few HIPAA-sensitive servers. I'm getting a list of shares just fine using gwmi Win32_Share
, however when I go to get the permissions on each share using gwmi Win32_LogicalShareSecuritySetting
, the hidden administrative shares are not listed.
I realize that's for obvious reasons, it's not like the permissions change, but I would like some kind of indication that this is in fact an administrative share. Currently I'm using a try-catch block to handle the error and kicking out a 'permissions could not be found' message.
Is there any way I can list ONLY hidden administrative shares using PowerShell?
Solution 1:
Try (change "." to your remote computer name):
[String] $Local:strComputerName = ".";
[System.Management.ManagementBaseObject[]] $Local:arrShares = @();
[System.Management.ManagementBaseObject] $Local:objShare = $null;
$arrShares = Get-WMIObject -class "Win32_Share" -namespace "root\CIMV2" -computername $strComputerName -ErrorAction SilentlyContinue | Where-Object { $_.Type -eq 2147483648 };
if ( $? ) {
foreach ( $objShare in $arrShares ) {
# List attributes (other attributes include AccessMask, AllowMaximum, Description,
# InstallDate, MaximumAllowed, Status and Type).
Write-Host -Object ( "Name : {0}" -f $objShare.Name );
Write-Host -Object ( "Path : {0}" -f $objShare.Path );
Write-Host -Object ( "Caption : {0}" -f $objShare.Caption );
Write-Host -Object "";
} #foreach
} else {
Write-Host -Object "ERROR.";
} #else-if