Identifying and deleting hidden shares is one of the pressing problems for system administrators. In this post, I will explain you how to get list of hidden shares in a computer(s).
To list hidden share in local computer, simply run
gwmi -class win32_share | ? { ($_.type -eq “0” ) -and ($_.Name -match “w$”)}
The above oneliner gets list of shares in local computers and filters the disk type shares and looks for the share names that are ending with “$” symbol which indicates a hidden share.
You can simply run this against a remote computer by passing -computername parameter like below.
gwmi -computername <remotepc> -class win32_share | ? { ($_.type -eq “0” ) -and ($_.Name -match “w$”)}
Similarly, if you have a list of computers and you want to know the hidden shares, use the below two line code
$mycomputers = Get-Content c:tempmycomputers.txt
$mycomputers | gwmi -computername $_ -class win32_share ? {($_.type -eq “0”) -and ($_.Name -match “w$”) }
In above code, first we are reading the list of computers into a variable and passing them one by one to our previous command which generates the list of hidden shares in remote computer.
Hope this helps.