Get list of hidden shares in your network using powershell
Identifying and deleting hidden shares is one of the pressing problems for system administrators. In this post, I will explain you how to get list of hidden shares in a computer(s).
To list hidden share in local computer, simply run
gwmi -class win32_share | ? { ($_.type -eq “0″ ) -and ($_.Name -match “w$”)}
The above oneliner gets list of shares in local computers and filters the disk type shares and looks for the share names that are ending with “$” symbol which indicates a hidden share.
You can simply run this against a remote computer by passing -computername parameter like below.
gwmi -computername <remotepc> -class win32_share | ? { ($_.type -eq “0″ ) -and ($_.Name -match “w$”)}
Similarly, if you have a list of computers and you want to know the hidden shares, use the below two line code
$mycomputers = Get-Content c:tempmycomputers.txt
$mycomputers | gwmi -computername $_ -class win32_share ? {($_.type -eq “0″) -and ($_.Name -match “w$”) }
In above code, first we are reading the list of computers into a variable and passing them one by one to our previous command which generates the list of hidden shares in remote computer.
Hope this helps.
This doesn’t work for me. I copied and pasted the command, maybe I have a syntax error?
gwmi -computername svdc1abc.corp.domain.com -class win32_share | ? { ($_.type -eq “0? ) -and ($_.Name -match “w”$)
Nothing shows up, I just go back to the prompt.
Thanks.
Hey Mike, Yes there is a syntax error in the code you are using. Try the below.
gwmi -class win32_share -computername svdc1abc.corp.domain.com | ? { ($_.type -eq “0″ ) -and ($_.Name -match “w$”)}
In the code you are using, there is a question mark after “0″ which is the problem. Let me know if you still can not make it.
Works great. Thanks for finding my syntax error. Something must have happened during my copy and paste. Thanks for the good tool.