Identifying and deleting hidden shares is one of the pressing problems for system administrators. In this post, I will explain you how to get list of hidden shares in a computer(s).
To list hidden share in local computer, simply run
gwmi -class win32_share | ? { ($_.type -eq “0” ) -and ($_.Name -match “w$”)}
The above oneliner gets list of shares in local computers and filters the disk type shares and looks for the share names that are ending with “$” symbol which indicates a hidden share.
You can simply run this against a remote computer by passing -computername parameter like below.
gwmi -computername <remotepc> -class win32_share | ? { ($_.type -eq “0” ) -and ($_.Name -match “w$”)}
Similarly, if you have a list of computers and you want to know the hidden shares, use the below two line code
$mycomputers = Get-Content c:tempmycomputers.txt
$mycomputers | gwmi -computername $_ -class win32_share ? {($_.type -eq “0”) -and ($_.Name -match “w$”) }
In above code, first we are reading the list of computers into a variable and passing them one by one to our previous command which generates the list of hidden shares in remote computer.
Hope this helps.
Comments on this entry are closed.
This doesn’t work for me. I copied and pasted the command, maybe I have a syntax error?
gwmi -computername svdc1abc.corp.domain.com -class win32_share | ? { ($_.type -eq “0? ) -and ($_.Name -match “w”$)
Nothing shows up, I just go back to the prompt.
Thanks.
Hey Mike, Yes there is a syntax error in the code you are using. Try the below.
gwmi -class win32_share -computername svdc1abc.corp.domain.com | ? { ($_.type -eq “0” ) -and ($_.Name -match “w$”)}
In the code you are using, there is a question mark after “0” which is the problem. Let me know if you still can not make it.
Works great. Thanks for finding my syntax error. Something must have happened during my copy and paste. Thanks for the good tool.
Very frustrated about this. I have a server with upwards of 20,000 shares. Getting these shares using WMI, whether locally or remote, is killingly slow – over five minutes. It takes as long to get a single share as to get them all.
This is true whether doing a WMI query locally or remotely. The ancient old ‘net share’ command can show them immediately on the machine itself, so clearly there is some other API that can get the information – but there is no way to pass in a remote computer name to net share.
Anyone have any idea??
jj
You may want to try http://www.nirsoft.net/utils/netresview.html.