Cannot Connect to Default Administrative Share C$ on Windows 2008 R2

The other day I had the need to browse out to one of my Windows 2008 R2 servers using one of the default administrative shares, such as C$.  

Trying to browse out using a UNC path of \\SERVER1\C$\FOLDER1 and I received an error “Access Denied”.

Trying to map a drive to \\SERVER1\C$ also returned an “Access Denied”.

After a little research, I learned that UAC (User Account Control) is set up to not allow access to the default shares remotely.

There is even a Microsoft KB article on this here.

To fix this issue and enable, simply launch RegEdit and set the following key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system\ LocalAccountTokenFilterPolicy

0 = build filtered token (Remote UAC enabled)
1 = build elevated token (Remote UAC disabled)

By setting the DWORD entry to 1, you will be able to access the administrative shares since the remote logon token will not be filtered.

LocalACcountTokenFilterPolicy

Hope this helps!

This entry was posted in Troubleshooting, Windows 2008. Bookmark the permalink.

3 Responses to Cannot Connect to Default Administrative Share C$ on Windows 2008 R2

  1. Mark says:

    Is the registry key placed on the target (in your case the 2008R2 server) or the machine you are connecting from? Since it is “building an elevated token” I’m assuming on the machine you are connecting from, but I may be wrong.
    Thanks

    • dmohorn says:

      Hi, mark.

      Set the registry on the server you’re trying to connect to. This will allow its administrative shares (C$) to become available remotely.

  2. John says:

    Thank you for this, this solution worked for me.

Leave a Reply

Your email address will not be published. Required fields are marked *

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>