Entire C drive suddenly gets shared Win 10 pro
I noticed that my entire C drive became shared (actual normal share not the default C$) Is there anywhere a log that can be checked for what caused the creation of a share? My current 1st suspect is probably filezilla doing some wonky stuff, since it's the only new addition to the system since I noticed C drive being shared.
windows-10 network-shares shared-folders
asked Jan 16 at 12:58
polyxpolyx
61
add a comment |
I noticed that my entire C drive became shared (actual normal share not the default C$) Is there anywhere a log that can be checked for what caused the creation of a share? My current 1st suspect is probably filezilla doing some wonky stuff, since it's the only new addition to the system since I noticed C drive being shared.
windows-10 network-shares shared-folders
asked Jan 16 at 12:58
polyxpolyx
61
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21
add a comment |
I noticed that my entire C drive became shared (actual normal share not the default C$) Is there anywhere a log that can be checked for what caused the creation of a share? My current 1st suspect is probably filezilla doing some wonky stuff, since it's the only new addition to the system since I noticed C drive being shared.
windows-10 network-shares shared-folders
asked Jan 16 at 12:58
polyxpolyx
61
I noticed that my entire C drive became shared (actual normal share not the default C$) Is there anywhere a log that can be checked for what caused the creation of a share? My current 1st suspect is probably filezilla doing some wonky stuff, since it's the only new addition to the system since I noticed C drive being shared.
windows-10 network-shares shared-folders
windows-10 network-shares shared-folders
asked Jan 16 at 12:58
polyxpolyx
61
asked Jan 16 at 12:58
polyxpolyx
61
asked Jan 16 at 12:58
polyxpolyx
61
asked Jan 16 at 12:58
polyxpolyx
61
asked Jan 16 at 12:58
polyxpolyx
61
61
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21
add a comment |
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21
add a comment |
1 Answer
1
active
oldest
votes
Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.
That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1394935%2fentire-c-drive-suddenly-gets-shared-win-10-pro%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.
That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
add a comment |
Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.
That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
add a comment |
Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.
That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
Open your Event Viewer and filter for Event ID 5142. This should record the Security Identifier of the object that created the share.
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-5142
HOWEVER, in my own inspection, on a server I just created a new share on, I did not find any events of this ID, so I assume it may be necessary to have some sort of auditing enabled first.
That said, it doesn't hurt to look, and IF a share was created on your computer of your entire C drive, AND such an event was logged, it would be logged using that Event ID.
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
answered Jan 16 at 17:26
music2myearmusic2myear
31.2k858100
31.2k858100
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1394935%2fentire-c-drive-suddenly-gets-shared-win-10-pro%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Where are you seeing that the drive has been shared?
– music2myear
Jan 16 at 17:21