Network Shares

User-defined network shares on this host, with their paths and permissions.

Use it to spot a new or over-permissive share that exposes files or aids lateral movement.

  • SYSTEM
  • Defence Evasion

What It Is

A network share is a folder that the Server service (LanmanServer) offers to other computers on the network. This key, in the SYSTEM hive, holds the shares created on the machine, with each share's name and permissions. Windows also creates hidden administrative shares, such as C$, ADMIN$ and IPC$, by itself, so administrators and programs can manage the machine.

What It Proves

A value under the Shares key is a user-defined share, with its name, local path and permissions. A share of a sensitive path, or one open to Everyone, widens what the host exposes on the network.

What It Does Not Prove

The default admin shares (C$, ADMIN$, IPC$) are created dynamically and are not stored here, so this key holds only shares someone added. It shows the share exists, not who connected.

Where It Lives

Network Shares lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SYSTEM\ControlSet001\Services\LanmanServer\Shares
Hive file: C:\Windows\System32\config\SYSTEM

What It Looks Like

These are two values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Network Shares, each with what it tells you
Registry ValueWhat It Tells You

Backup

REG_MULTI_SZPath=C:\ ShareName=Backup Type=0

The whole C drive is shared on the network as Backup. Decode who may connect from Shares\Security. Event 5140 shows who did, if File Share auditing is on.

Data

REG_MULTI_SZPath=D:\Finance ShareName=Data

A finance folder is shared on the network. Confirm it is expected and review its permissions and recent access.

How to Read It

Read the values under Services\LanmanServer\Shares, where each is one user-defined share. Parse the share name, Path and the security descriptor. Look for broad access or sensitive paths. To put it right, remove the unexpected share and review connections to it in event 5140 in the Security log, where Audit File Share is on.

When Windows Writes It
When an administrator, net share, or an attacker with admin rights adds or changes a share.
Which Windows Versions
Windows XP to 11
Tools That Parse It
Registry Explorer, RECmd, RegRipper (shares)

Hunt It

Sees Related ActivityDeviceEvents (NetworkShareObjectAdded) (documentation, opens in a new tab)

Records shares as they are created, inside retention. AdditionalFields carries the share details. It does not read the Shares key, so a quiet result does not clear the host.

KQLDefender XDR, Advanced hunting
// Network shares Defender saw being addedDeviceEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where ActionType == "NetworkShareObjectAdded"| project Timestamp, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, AdditionalFields| order by Timestamp desc

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Network Shares shows.

  • Firewall RulesShows whether the firewall lets file sharing in, which decides who could reach the share.
  • Share Added, Security Event 5142Not in the RegistryRecords when the share was added, and by which account.
  • Share Accessed, Security Event 5140Not in the RegistryShows who connected to the share, if file share auditing is on.

Sources

The facts on this page come from these public pages, which say more on each point.