commvault.com commvault.com
Question

MediaAgent - Windows Administrative Shares

  • 6 March 2024
  • 1 reply
  • 258 views
G
Rank
Badge +4

Hi all,

After installing the MediaAgent Package on some Windows Servers (These just require the component and do not not act as a Data Mover or host a DR Share) I get the once a day 64:1142 Critical Code Event logged:  Administrative share are enabled on the MediaAgent XXX which could lead to potential security exploits, please review and take necessary steps.

Having reviewed https://kb.commvault.com/article/72274 this article only really seems concerned with disk libraries and DR Shares that use an Admin share in its path.

 

I have 2 servers that this is being logged in event viewer for, yet they only have the default C$, Admin$ and IPC$.  Should Commvault be flagging the C$ as something that should be removed?  Indeed if I apply a reg key (AutoShareServer = 0) the alert is suppressed, but this also removes the Admin$ Share.  

 

Are these alerts in the Event Viewer supposed to be triggered for these default Shares by design or is it being over zealous and picking up these in error?  The Critical Warnings seem to indicate a misconfiguration, but as they are not being use for Mount Paths or DR Shares I wouldn’t think this is the case.  

 

For context this is related to a 11.32 Install.

Any input on this would be appreciated.

 

Thanks,

G

1 reply

Chris Hollis
Rank
Userlevel 6
Badge +15

@G.lee 

This is expected behaviour and is part of our ransomware protection feature as far as i’m aware:

https://documentation.commvault.com/2024/essential/enabling_ransomware_protection_on_mediaagent.html

https://documentation.commvault.com/2024/expert/ransomware_protection_for_disk_libraries_on_windows_mediaagent_02.html

“Administrative shares pose a security vulnerability on disk library mount paths and must be disabled on the MediaAgents hosting the shares.”
 

The software isn’t checking to see how the shares are configured, it’s just alerting you that the administrative shares are enabled on the server that has the media agent package, therefore we recommend you disable it otherwise it could be used to exploit your environment. 

If the server isn’t being used as an actual media agent, then feel free to disable the ransomware option on it. 

Here are the MSFT steps to disable the feature if you wanted: https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/remove-administrative-shares


HTH

Regards,

Chris
​​​​​​​


 

Reply


Terms & ConditionsCookie settings